CVE-2024-23831: Ledgersmb

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used to create a new user account with full application (/login.pl) privileges, leading to privilege escalation. The vulnerability is patched in versions 1.10.30 and 1.11.9.

Affected products

• Ledgersmb Ledgersmb: from 1.3.0, before 1.10.30 (fixed in 1.10.30); from 1.11.0, before 1.11.9 (fixed in 1.11.9)

Published 2024-02-02. Last modified 2026-06-17.