FrontAccounting CVE-2026-80211

Exploitation requires prior read access to the FrontAccounting database or users table - the weak hashing cannot be exploited without first obtaining the stored digests through a separate attack vector such as SQL injection, a publicly exposed database port, backup file disclosure, or server-level compromise. All FrontAccounting deployments through 2.4.20 using the built-in authentication system are affected regardless of configuration; the codebase provides no option to enable stronger hashing. The AC:H rating reflects this prerequisite: direct unauthenticated remote password cracking is not possible without the database exfiltration step. Limiting factors include: the attacker must successfully breach the database layer first; weak or long unique passwords still require significant GPU time to crack even against unsalted MD5; and organizations enforcing unique per-service passwords limit downstream credential-stuffing impact.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately characterizes the attack profile: high complexity (AC:H) because exploitation requires a prerequisite database access step, but high confidentiality impact (VC:H) because once the user table is obtained, all passwords are practically recoverable. MD5 processes billions of hashes per second on consumer GPUs, making even moderately complex passwords crackable within hours or days. No EPSS data was provided, and no CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis. The real-world risk is most acute in post-breach credential-stuffing scenarios - users who reuse FrontAccounting passwords on other services face compounded exposure. The risk is bounded by the AC:H prerequisite: unauthenticated direct remote cracking is not possible without first exfiltrating the database via a separate vulnerability. Organizations with adequate database perimeter controls reduce their exposure materially, but the underlying hash weakness remains a latent risk in any compromise.

An attacker exploits a SQL injection flaw or misconfigured database exposure to extract FrontAccounting's users table, obtaining unsalted MD5 password digests for all accounts. Using hashcat in MD5 mode against a common-password wordlist or a precomputed rainbow table, the attacker recovers plaintext passwords for the majority of accounts within hours on consumer GPU hardware. The recovered credentials are then used to authenticate directly to FrontAccounting (gaining access to financial data) or submitted to credential-stuffing tools targeting other services where users have reused the same password.