BillaBear CVE-2026-116257

The required condition is that the BillaBear InstallController's processInstall endpoint is network-reachable and, per the description, performs no authentication check, allowing a remote unauthenticated request. The practical limiting factor is exposure of the installation route: exploitation depends on that endpoint remaining accessible rather than being removed or locked after setup, and the available sources do not describe whether processInstall can be re-triggered on an already-installed instance. No authentication, privileges, or user interaction are needed per the CVSS vector (PR:N/UI:N). Affected version is BillaBear up to 2025.01.03; no fixed version is listed and the vendor did not respond.

This is a medium-severity (CVSS 4.0 base 5.5, provided vendor/VulDB vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) missing-authentication flaw (CWE-306) in BillaBear's Installation Handler. The signals are mixed and point to real but bounded risk rather than an emergency: the network, low-complexity, no-privilege, no-interaction metrics (AV:N/AC:L/PR:N/UI:N) make the endpoint trivially reachable, but the impact metrics are all Low (VC:L/VI:L/VA:L), and exploit maturity is only E:P (proof-of-concept). The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a reachable but moderate-impact issue. A public PoC reference exists (a gist); it is not verified as working exploit code. This is NOT in CISA KEV - there is no confirmation of active exploitation - so exploitation status is a disclosed PoC reference only, not in-the-wild use. No EPSS score is provided, so widespread-exploitation probability cannot be quantified from the input. The vendor was contacted and did not respond, and no fixed version is listed, meaning an exposed instance currently has no vendor patch. Net: treat as a genuine but non-critical web-exposure issue - the easy attack vector raises its practical priority above its modest CVSS, but the all-Low impact and PoC-only maturity argue against emergency handling.

A remote, unauthenticated attacker locates an internet-reachable BillaBear instance and sends a crafted request to the processInstall action of InstallController.php, which does not verify authentication. Because the attack is network-based with low complexity and no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N), the request can be issued directly; a public PoC reference exists (a gist) but is not verified as working exploit code. The exact trigger and whether it succeeds against an already-installed instance are not described in the available sources.