Which versions of FOSSBilling are affected by CVE-2026-33543?

FOSSBilling 0.7.2 and earlier contain a critical authentication bypass enabling remote, unauthenticated attackers to create administrator accounts without authentication, resulting in complete…. A patch is available.

How to fix or mitigate CVE-2026-33543?

Within 24 hours: Immediately restrict network access to FOSSBilling instances (firewall/VPN only) or deploy WAF rules blocking POST requests to /api/guest/staff/create. Within 7 days: Conduct internal audit to verify no unauthorized admin accounts were created; review authentication logs for suspicious activity spanning the period the instance was exposed. Within 30 days: Coordinate with vendor for patch timeline or plan migration to patched version or alternative billing platform.

FOSSBilling CVE-2026-33543

Q: What is the CVSS score of CVE-2026-33543?

CVE-2026-33543 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39096 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-24 security-advisories@github.com

Authentication Bypass

9.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Single unauthenticated network request creates a full admin account (PR:N/UI:N/AC:L), granting complete control over the application, so confidentiality, integrity, and availability are all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 21:36 vuln.today

Analysis Generated

Jun 24, 2026 - 21:36 vuln.today

DescriptionCVE.org

FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already exists. The flawed guard check uses is_countable() on a value that returns a Model_Admin object or null rather than a countable type, causing the expression to always evaluate as true and bypass the intended protection. As a result, an attacker can reach the unprotected endpoint to create a new administrator account and immediately authenticate, gaining a fully privileged admin session even when an admin already exists. This issue has been fixed in version 0.8.0.

AnalysisAI

Authentication bypass in FOSSBilling 0.7.2 and earlier lets remote unauthenticated attackers create a fully privileged administrator account through the guest bootstrap endpoint /api/guest/staff/create, which fails to lock after the first admin exists. Because the account can immediately authenticate, this yields complete takeover of the billing and client-management platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial network-based exploitation (CVSS 4.0 9.3) makes it a serious exposure for any internet-facing instance.

Technical ContextAI

FOSSBilling is a PHP-based open-source billing and client-management application that exposes a set of unauthenticated 'guest' API routes. The endpoint /api/guest/staff/create is meant to run only once, during initial setup, to bootstrap the first administrator. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the guard intended to disable the endpoint after an admin exists calls is_countable() on a value that is actually a Model_Admin object (or null) rather than an array/Countable. is_countable() returns false for both, but the surrounding boolean expression is structured so the check always evaluates as if no admin exists, leaving the bootstrap path permanently open. The fix in 0.8.0 is part of a broader refactor of the guest API routes (#3474) to expose less functionality publicly.

RemediationAI

Vendor-released patch: upgrade to FOSSBilling 0.8.0, which corrects the admin-existence check and refactors the guest API routes to expose less publicly. Note that 0.8.0 is a larger release with breaking changes - it requires PHP 8.3 or newer, removes the public guest version endpoint, reworks Box_Mod into FOSSBilling\Module, and changes the frontend build system - so back up the installation and review the release notes before upgrading, especially if you run custom modules, themes, or API integrations. If an immediate upgrade is not possible, restrict reachability of the /api/guest/staff/create route at the web server or WAF layer (block or return 403 for that path), and place the admin/API surface behind an IP allowlist or VPN; the trade-off is that web-layer path blocking can be bypassed if routing differs and does not fix the underlying logic, so it is only a stopgap. Refer to advisory GHSA-28mh-j262-q49w (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-28mh-j262-q49w) and the 0.8.0 release notes (https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0) for details.