Is CVE-2026-40524 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-40524?

CVE-2026-40524 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-40524

Description

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.