Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80210— FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms

Quick assessment

Affected
FrontAccounting FrontAccounting
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FrontAccounting ERP是FrontAccounting ERP个人开发者开源的一款企业资源计划管理系统。 FrontAccounting ERP 2.4.20及之前版本存在跨站请求伪造漏洞，该漏洞源于在end_form()中生成CSRF令牌但未在金融交易处理器中验证，导致容易受到跨站请求伪造攻击，攻击者可诱导已认证用户加载恶意页面自动提交跨域表单，伪造日记账分录、发票、客户付款、银行交易或公司配置更改。

CVSS 6.5 · Medium EPSS 0.22% · P12

Affected Version Matrix 1

VendorProduct Version RangeStatus
FrontAccounting FrontAccounting ≤ 2.4.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80210

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
Source: CVE Program / CVE List V5
Vulnerability Description
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
FrontAccounting ERP 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FrontAccounting ERP是FrontAccounting ERP个人开发者开源的一款企业资源计划管理系统。 FrontAccounting ERP 2.4.20及之前版本存在跨站请求伪造漏洞，该漏洞源于在end_form()中生成CSRF令牌但未在金融交易处理器中验证，导致容易受到跨站请求伪造攻击，攻击者可诱导已认证用户加载恶意页面自动提交跨域表单，伪造日记账分录、发票、客户付款、银行交易或公司配置更改。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
FrontAccounting FrontAccounting 0 ~ 2.4.20 -

II. Public POCs for CVE-2026-80210

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80210

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-80210 (1)

Proof of Concept for CVE-2026-80210 (2)

Vendor Pages for CVE-2026-80210 (1)

IV. Related Vulnerabilities

Same product: FrontAccounting
Same vendor: FrontAccounting
Same weakness: CWE-352

V. Comments for CVE-2026-80210

No comments yet

Leave a comment