CVE-2026-80210
Received Received - Intake

CSRF Token Validation Bypass in FrontAccounting

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80210
EUVD
EUVD-2026-67144

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frontaccounting frontaccounting to 2.4.20 (inc)
frontaccounting frontaccounting 2.4.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in FrontAccounting 2.4.20. The software generates CSRF tokens for forms but only validates them in two admin pages. Financial transaction forms like invoices, payments, and journal entries do not validate these tokens, allowing attackers to trick authenticated users into submitting unauthorized requests.

Detection Guidance

To detect this vulnerability, review FrontAccounting's financial transaction forms (GL journals, invoices, payments, etc.) for missing CSRF token validation. Check if POST requests to these endpoints are processed without token checks. Inspect the ui_controls.inc file for end_form() and verify if check_csrf_token() is called in all transaction handlers.

Impact Analysis

An attacker could exploit this to perform unauthorized financial actions such as creating fake invoices, modifying transactions, or changing company settings without the user's knowledge. This requires the victim to visit a malicious page while logged into FrontAccounting.

Compliance Impact

This CSRF flaw could lead to unauthorized data changes or financial fraud, violating integrity and accountability requirements in GDPR and HIPAA. Unauthorized transactions may result in non-compliance with audit and security controls.

Mitigation Strategies

Immediately update FrontAccounting to the latest version that includes CSRF token validation for all financial transaction forms. As a temporary measure, restrict access to sensitive endpoints via network controls or disable non-essential forms. Also, enforce SameSite cookie attributes and replace MD5 password hashing with bcrypt.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart