Is CVE-2026-40524 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40524 being exploited in the wild.

How severe is CVE-2026-40524?

High severity, with a CVSS score of 8.1, published 29 June 2026.

Is there a fix for CVE-2026-40524?

A patch was published on 2026-04-28: Release 2.4.20 published with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40524 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40524?

Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40524: FrontAccounting SQL injection in get_gl_transactions

CVE-2026-40524 · Severity: high · CVSS 8.1 · Published 2026-06-29

FrontAccounting, an open-source enterprise resource planning (ERP) system, contains a security flaw in its reporting module. An attacker with basic reporting permissions can manipulate database queries to bypass security filters and extract sensitive financial data, such as journal entries and password hashes. This could lead to a significant breach of corporate financial records and unauthorized access to administrative accounts.

Technologies: FrontAccounting. Vendors: FrontAccounting.

Quick answers

Is CVE-2026-40524 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40524 being exploited in the wild.
How severe is CVE-2026-40524?: High severity, with a CVSS score of 8.1, published 29 June 2026.
Which products and versions are affected?: FrontAccounting < 2.4.20.
Is there a fix for CVE-2026-40524?: A patch was published on 2026-04-28: Release 2.4.20 published with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40524 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40524?: Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in FrontAccounting versions prior to 2.4.20 within the get_gl_transactions() function located in gl/includes/db/gl_db_trans.inc. The root cause is the direct concatenation of the $filter_type parameter (sourced from $_POST['PARAM_2'] in rep702.php) into a SQL IN() clause without parameterization or escaping. An authenticated attacker with SA_GLANALYTIC permissions can break out of the IN() clause using a closing parenthesis and inject arbitrary SQL conditions. Because the application returns a PDF report, attackers can use a boolean-based blind technique by observing the significant response size differential between 'true' (full report) and 'false' (empty report) conditions to exfiltrate data. The vulnerability is patched in version 2.4.20 by implementing db_escape() on the affected parameter.

Affected products

FrontAccounting FrontAccounting < 2.4.20

Timeline

2026-04-28: patched: Release 2.4.20 published with security fixes
2026-06-29: disclosed: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.