CVE-2026-27604criticalCWE-200CWE-306CWE-862CWE-863

CVE-2026-27604: critical vulnerability in FOSSBilling

FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

Published

Follow this CVE+ Monitor FOSSBilling

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 10epss 1.3%
In short

FOSSBilling has a critical flaw that allows attackers to access powerful admin functions through the API without logging in or providing any credentials. This means anyone on the internet can potentially take control of billing systems and user data.

Technical detail

An authorization bypass in API role validation (CWE-200, CWE-306, CWE-862, CWE-863) permits unauthenticated requests to `/api/system/*` endpoints by exploiting improper resolution of the 'system' role to cron admin identity. No valid credentials, session tokens, or CSRF protections are enforced, enabling direct invocation of privileged admin API methods. Affects versions 0.5.4 through 0.7.x; patched in 0.8.0.

Summary generated and translated by AI from the official description.
FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged `/api/system/*` endpoints. Because `system` resolves to the cron admin identity, attackers can invoke admin API methods without valid credentials, session, or CSRF token. Version 0.8.0 patches the issue. Some workarounds are available. Block external access to `/api/system/*` at reverse proxy/WAF, restrict API access by trusted source IPs only (`api.allowed_ips`), rotate all admin/client API tokens immediately, invalidate active sessions and reset high-privilege credentials, and/or review API request logs for suspicious `/api/system/` access and treat as potential incident.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
FOSSBilling · FOSSBilling
Related CVEs — FOSSBilling

In the same product, most dangerous first.

CVE-2026-28496CRITICALFOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCEEPSS 1.9%CVE-2026-43920MEDIUMFOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance executionEPSS 0.9%CVE-2026-53647MEDIUMFOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpointEPSS 0.5%CVE-2026-43925MEDIUMFOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code useEPSS 0.5%CVE-2026-33543CRITICALFOSSBilling: Authentication bypass allows unauthenticated administrator creationEPSS 0.4%CVE-2026-53641MEDIUMFOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literalEPSS 0.4%