CVE-2026-80210 FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
Attackers can forge financial transactions and modify company settings by tricking authenticated users into submitting malicious forms due to missing CSRF validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-80210?
CVE-2026-80210 is a high-severity vulnerability in FrontAccounting, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.
Weakness: CWE-352
Which versions are affected by CVE-2026-80210?
How do I fix CVE-2026-80210?
No fix has been published for CVE-2026-80210 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-80210 being exploited?
There is no known exploitation of CVE-2026-80210 in the wild and no public exploit code.
Sources
Also known as GHSA-5wxj-x5xj-28rp.