CVE-2026-80210— FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
Quick assessment
Affected
FrontAccounting FrontAccounting
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FrontAccounting 2.4.20 及更早版本在 的 函数中生成 CSRF token，并将其作为 隐藏字段嵌入到其渲染的每个表单中。然而，只有 和 调用了 对该 token 进行校验。其他处理财务交易的端点均未校验该 token，包括： 因此，这些端点在处理 POST 数据时未进行来源检查。攻击者若能让已认证用户访问攻击者控制的页面，即可自动提交跨域表单，从而以受害者的会话身份记录伪造的日记账分录、发票、客户付款、银行交易或公司配置变更。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80210
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
Source: CVE Program / CVE List V5
Vulnerability Description
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FrontAccounting | FrontAccounting | 0 ~ 2.4.20 | - |
|
II. Public POCs for CVE-2026-80210
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80210
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-80210 (1)
Proof of Concept for CVE-2026-80210 (2)
Vendor Pages for CVE-2026-80210 (1)
IV. Related Vulnerabilities
Same product: FrontAccounting
-
CVE-2026-80211
FrontAccounting through 2.4.20 Use of Unsalted MD5 for Passw -
CVE-2026-40521
FrontAccounting < 2.4.20 Path Traversal RCE via attachment u -
CVE-2026-40522
FrontAccounting < 2.4.20 SQL Injection via rep601.php -
CVE-2026-40523
FrontAccounting < 2.4.20 SQL Injection via reporting/rep710. -
CVE-2026-40524
FrontAccounting < 2.4.20 SQL Injection via get_gl_transactio
Same vendor: FrontAccounting
-
CVE-2026-80211
FrontAccounting through 2.4.20 Use of Unsalted MD5 for Passw -
CVE-2026-40521
FrontAccounting < 2.4.20 Path Traversal RCE via attachment u -
CVE-2026-40522
FrontAccounting < 2.4.20 SQL Injection via rep601.php -
CVE-2026-40523
FrontAccounting < 2.4.20 SQL Injection via reporting/rep710. -
CVE-2026-40524
FrontAccounting < 2.4.20 SQL Injection via get_gl_transactio
Same weakness: CWE-352
-
CVE-2026-81273
WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Req -
CVE-2026-81271
WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Reques -
CVE-2026-48549
Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie -
CVE-2026-48548
Nagios Core CSRF via cmd.cgi -
CVE-2026-78280
WordPress Hash Form plugin <= 1.4.0 - Cross Site Request For
V. Comments for CVE-2026-80210
No comments yet