CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in end form() in includes/ui/ui controls.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/change current user password.php call check csrf token() to validate it. No financial transaction handler validates the token, including gl/gl journal.php, gl/gl bank.php, purchasing/supplier invoice.php, sales/customer invoice.php, sales/customer payments.php and admin/company preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.