CVE-2026-40524: Frontaccounting

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

Affected products

• Frontaccounting Frontaccounting: before 2.4.20 (fixed in 2.4.20)

Published 2026-06-29. Last modified 2026-07-01.