Is CVE-2026-80211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80211 being exploited in the wild.

How severe is CVE-2026-80211?

Medium severity, with a CVSS score of 5.9, published 27 August 2026.

Which products and versions are affected?

FrontAccounting through 2.4.20.

Is there a fix for CVE-2026-80211?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80211 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-80211?

Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80211: FrontAccounting weak password hashing with unsalted MD5

CVE-2026-80211 · Severity: medium · CVSS 5.9 · Published 2026-08-27

FrontAccounting is an open-source enterprise resource planning (ERP) system used to manage business operations and accounting. The software stores user passwords as unsalted MD5 hashes, a cryptographically weak practice that allows attackers who gain access to the user database to recover plaintext passwords rapidly using precomputed lookup tables or GPU-based cracking. This could lead to unauthorized system access and potential compromise of sensitive financial and operational data.

Technologies: FrontAccounting. Vendors: FrontAccounting.

Quick answers

Is CVE-2026-80211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80211 being exploited in the wild.
How severe is CVE-2026-80211?: Medium severity, with a CVSS score of 5.9, published 27 August 2026.
Which products and versions are affected?: FrontAccounting through 2.4.20.
Is there a fix for CVE-2026-80211?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80211 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-80211?: Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

FrontAccounting through version 2.4.20 uses unsalted MD5 hashing for password storage and authentication across multiple code paths: admin/users.php, admin/change_current_user_password.php, and the forgotten-password recovery in includes/current_user.inc all pass md5($_POST['password']) directly to password functions. The authentication process calls get_user_auth($loginname, md5($password)), comparing MD5 digests without any per-password salt or adaptive hashing algorithm. Identical passwords produce identical digests, enabling rapid plaintext recovery via rainbow tables or high-rate GPU cracking if the user table is obtained through SQL injection, database breach, or file system access. No patch status is publicly documented; mitigation requires migrating to bcrypt, scrypt, or Argon2-based hashing with proper salting.

Affected products

FrontAccounting FrontAccounting through 2.4.20

Timeline

2026-08-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.