Is CVE-2026-40523 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40523 being exploited in the wild.

How severe is CVE-2026-40523?

High severity, with a CVSS score of 8.1, published 29 June 2026.

Is there a fix for CVE-2026-40523?

A patch was published on 2026-04-28: Release 2.4.20 published with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40523 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-40523?

Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40523: FrontAccounting SQL injection in Audit Trail report handler

CVE-2026-40523 · Severity: high · CVSS 8.1 · Published 2026-06-29

FrontAccounting, an open-source accounting system, contains a security flaw in its Audit Trail reporting feature. An authorized user with standard accounting permissions can execute unauthorized database commands. This could allow an attacker to steal sensitive financial data or crash the database by forcing it to perform extremely slow operations, potentially locking out all other users.

Technologies: FrontAccounting. Vendors: FrontAccounting.

Quick answers

Is CVE-2026-40523 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40523 being exploited in the wild.
How severe is CVE-2026-40523?: High severity, with a CVSS score of 8.1, published 29 June 2026.
Which products and versions are affected?: FrontAccounting < 2.4.20.
Is there a fix for CVE-2026-40523?: A patch was published on 2026-04-28: Release 2.4.20 published with security fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40523 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-40523?: Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in FrontAccounting's Audit Trail report handler (reporting/rep710.php) due to improper sanitization of the PARAM_2 and PARAM_3 POST parameters. The PARAM_2 variable is concatenated into a SQL WHERE clause without integer casting or parameterization, while PARAM_3 is improperly handled in a string context. An authenticated attacker with SA_GLANALYTIC permissions can exploit this via UNION-based injection to extract data or time-based blind injection using SLEEP() functions. Notably, the SLEEP() function is amplified across JOIN result sets, allowing a single request to hold database connections open for extended periods, leading to connection exhaustion and denial of service. The issue is fixed in version 2.4.20 by implementing proper integer casting and database escaping.

Affected products

FrontAccounting FrontAccounting < 2.4.20

Timeline

2026-04-28: patched: Release 2.4.20 published with security fixes.
2026-06-29: disclosed: Public disclosure of CVE-2026-40523.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.