Which versions of FrontAccounting are affected by EUVD-2026-40079?

FrontAccounting versions prior to 2.4.20 contain a SQL injection vulnerability (CVE-2026-40524, CVSS 7.2) in the general ledger analysis function that allows authenticated users with specific…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-40079?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40079. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-40079?

Within 24 hours: Inventory all FrontAccounting deployments and document current versions. Within 7 days: Upgrade all production and non-production instances to FrontAccounting 2.4.20 or later. Within 30 days: Verify patch deployment across all environments and audit access controls for the SA_GLANALYTIC permission to restrict to authorized personnel only.

FrontAccounting EUVD-2026-40079

Q: What is the CVSS score of EUVD-2026-40079?

EUVD-2026-40079 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-40524 HIGH

SQL Injection (CWE-89)

2026-06-29 VulnCheck

GHSA-w5j4-x499-pfwp

SQLi Frontaccounting

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable with low complexity but needs the SA_GLANALYTIC privilege (PR:L); read-only blind data extraction yields C:H with no integrity or availability impact, contrary to the input's VA:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 14:22 vuln.today

DescriptionCVE.org

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

AnalysisAI

SQL injection in FrontAccounting's get_gl_transactions() function lets authenticated users holding the SA_GLANALYTIC permission read arbitrary database contents by injecting into the unparameterized filter_type parameter of a SQL IN() clause. The flaw enables boolean-based blind extraction of sensitive journal-entry and general-ledger data using reliable response-size differentials. Publicly available exploit code exists and a vendor patch shipped in 2.4.20, though there is no public exploit identified as actively exploited.

Technical ContextAI

FrontAccounting is an open-source, PHP/MySQL double-entry accounting and ERP web application. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the get_gl_transactions() routine concatenates the attacker-controlled filter_type value directly into the SQL IN(...) list rather than binding it as a parameter. By supplying a closing parenthesis followed by additional SQL, an attacker breaks out of the IN() set and appends arbitrary boolean conditions, turning the general-ledger analytics query into a blind SQLi oracle. The CPE cpe:2.3:a:frontaccounting:frontaccounting:*:*:*:*:*:*:*:* confirms the FrontAccounting application itself is the affected product across versions prior to 2.4.20.

RemediationAI

Vendor-released patch: upgrade to FrontAccounting 2.4.20 or later, which parameterizes the filter_type input; the corresponding code change is the upstream commit at https://github.com/FrontAccountingERP/FA/commit/647a18196caad27f96ea852e993c9e30f815357f and the release notes are at https://sourceforge.net/p/frontaccounting/news/2026/04/release-2420/. If immediate patching is not possible, the most effective compensating control is to revoke the SA_GLANALYTIC permission from all but fully trusted administrators, which prevents access to the vulnerable GL analytics report at the cost of disabling general-ledger analytics for those users. Additionally, restrict network access to the FrontAccounting instance (VPN/IP allowlist) and place a WAF rule in front of the GL transactions/analytics endpoint to block IN()-breakout payloads containing stray parentheses or SQL keywords in filter_type, accepting that WAF signatures can be bypassed and may cause false positives on legitimate filter values.