Which versions of FOSSBilling are affected by CVE-2026-43918?

FOSSBilling versions before 0.8.0 contain a critical session-management flaw allowing suspended or terminated users to retain full authenticated access indefinitely.. A patch is available.

How to fix or mitigate CVE-2026-43918?

24 hours: Audit all FOSSBilling installations for versions before 0.8.0; review active session logs for suspended/deactivated accounts currently accessing the system. 7 days: Schedule immediate upgrade to FOSSBilling 0.8.0 or latest version; implement forced session termination for deactivated accounts and enforce 4-hour maximum session lifetime for all roles. 30 days: Complete FOSSBilling upgrade to 0.8.0 or later; verify session identity loaders re-check account status on each request; enable real-time alerting for authenticated access from deactivated accounts.

FOSSBilling CVE-2026-43918

Q: What is the CVSS score of CVE-2026-43918?

CVE-2026-43918 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41956 HIGH

Insufficient Session Expiration (CWE-613)

2026-07-06 GitHub_M

PHP Information Disclosure Fossbilling

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

PR:L because a valid pre-existing authenticated session is required; AV:N/AC:L/UI:N as the retained session is used normally over the network; C/I/H/A:H reflect full role-level access being retained.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:27 vuln.today

DescriptionCVE.org

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing authenticated sessions are not invalidated. The session identity loaders in src/di.php (loggedin_client and loggedin_admin) only reject sessions if the backing account record no longer exists in the database. They do not verify that the account's status is still active. This allows a suspended or deactivated user to retain full access until their session naturally expires. This issue has been fixed in version 0.8.0.

Articles & Coverage 1

News 5 New PHP Vulnerabilities - 2 Critical, 3 High, 2 With POC Jul 07, 2026

AnalysisAI

Privilege retention in FOSSBilling before 0.8.0 allows a suspended or deactivated client, staff, or admin to keep full authenticated access because the session identity loaders in src/di.php never re-check account status. Suspending or deactivating a user does not terminate their live session - access persists until the session expires naturally. This is an authenticated (PR:L) session-management flaw with no public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it 8.7 (CVSS 4.0).

Technical ContextAI

FOSSBilling is a PHP-based open-source billing and client-management platform. The root cause is CWE-613 (Insufficient Session Expiration): the loggedin_client and loggedin_admin identity loaders in src/di.php authorize a request solely by confirming the backing account row still exists in the database, without evaluating the account's active/suspended/inactive status flag. Consequently the authorization decision is bound to record existence rather than record state, so an administrative status change (suspend/deactivate) has no effect on already-issued sessions. The CPE cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:* confirms the application itself (all pre-0.8.0 builds) is the affected component.

RemediationAI

Upgrade to FOSSBilling 0.8.0, which adds account-status verification to the session identity loaders (Vendor-released patch: 0.8.0); see the advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-qv6c-v49w-8g2j and release notes at https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0. If you cannot upgrade immediately, the direct compensating control is to forcibly terminate the affected user's sessions at the moment of suspension - clear or delete their server-side session records (or truncate the session store) so the stale session cannot resolve, accepting that this may also log out other users if you flush the whole store. As a lower-impact alternative, shorten the global session lifetime/idle timeout to reduce the retention window (trade-off: more frequent re-authentication for all legitimate users), and where feasible rotate credentials or reset the password of the deactivated account to break any client that reuses stored credentials.