FOSSBilling CVE-2026-111046

Requires an authenticated low-privileged staff account that already holds module-level extension access (PR:L); the account does NOT need the extension.manage_extensions permission, which is the core of the flaw. The targeted module must be a non-core module that is currently deactivated/inactive (the AT:P attack requirement) - the vulnerable early return in hasManagePermission on !isExtensionActive only triggers for inactive non-core modules, so active modules and core modules are not reachable via this path. The attacker must invoke api/admin/extension/config_get (to read decrypted retained secrets) or api/admin/extension/config_save (to overwrite stored configuration) for that specific module. Limiting factors: valid staff authentication is mandatory, exploitation is scoped to one deactivated non-core module, there is no availability impact, and fixed installations on 0.8.6 enforce the manage_extensions check.

This is a low-priority authorization flaw, not an urgent threat. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N) scores only 2.3 and the signals are internally consistent: network reachable but requiring an authenticated low-privileged staff account (PR:L) that already holds module-level extension access, plus a specific precondition (AT:P) that the targeted non-core module be deactivated. There is no CISA KEV listing and no public exploit code identified at time of analysis; a patch diff (PR #4184) is public, which aids reverse-engineering but is not itself a weaponized POC. No EPSS value was supplied in the input, so exploitation probability cannot be quantified. The real-world impact is bounded - confidentiality and integrity are rated Low (read of retained decrypted extension secrets and overwrite of stored extension config for one deactivated module), with no availability impact and no scope change. This is a defense-in-depth gap (hasManagePermission fails open) that primarily matters as an insider/privilege-boundary issue rather than a remote unauthenticated breach. Note the Tags label it 'Authentication Bypass' while CWE-862 and the description describe a missing-authorization (authorization bypass) condition - verify terminology with the advisory.

A low-privileged FOSSBilling staff member who holds module-level extension access, but not the manage_extensions permission, calls api/admin/extension/config_get against a deactivated non-core module and receives its decrypted retained secrets, then uses config_save to overwrite that module's stored configuration. No public exploit code exists, but the fix commit publicly reveals the vulnerable fail-open path. Exploitation is authenticated and limited to a single deactivated module at a time.