FrontAccounting Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token including gl/gl_journal.php gl/gl_bank.php purchasing/supplier_invoice.php sales/customer_invoice.php sales/customer_payments.php and admin/company_preferences.php so