FOSSBilling CVE-2026-43920
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint executes DROP TABLE and full session-token regeneration without constraint, warranting I:H and A:H despite predefined patch scope.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible without authentication, which allowed unauthenticated remote users to trigger update patch routines that modify configuration files, execute database schema changes, perform filesystem mutations, and clear caches. The /run-patcher endpoint executes privileged maintenance operations - configuration migrations, database patch execution (including ALTER TABLE, DROP TABLE, UPDATE statements), filesystem deletions and renames, and cache clearing - without requiring administrator authentication, CSRF validation, or CLI context. An unauthenticated remote attacker can trigger these operations by sending a simple HTTP GET request to /run-patcher, which can be abused for denial-of-service attacks. Certain patches (e.g., batch token regeneration for all admin and client accounts in patch 53, and session invalidation) are disruptive even when re-executed against an already-patched instance. Repeated or concurrent requests may also cause inconsistent database state. This issue has been fixed in version 0.8.0.
AnalysisAI
Unauthenticated remote access to the /run-patcher maintenance endpoint in FOSSBilling versions 0.5.4 through 0.7.2 allows any network-reachable attacker to trigger privileged database schema changes (including ALTER TABLE and DROP TABLE), configuration file migrations, filesystem mutations, and batch token regeneration for all admin and client accounts via a single HTTP GET request. The attack requires no credentials, no CSRF token, and no special headers, making it trivially automatable against any publicly exposed instance. No active exploitation has been confirmed in the CISA KEV catalog, but the attack surface is broad and the operational impact - forced session invalidation, potential database inconsistency from concurrent invocations, and cache destruction - constitutes a meaningful denial-of-service risk against production instances.
Technical ContextAI
FOSSBilling is an open-source PHP-based billing and client management platform. The root cause is CWE-306 (Missing Authentication for Critical Function): the /run-patcher HTTP endpoint, which executes versioned database migration patches during the upgrade lifecycle, was exposed to unauthenticated HTTP GET requests with no authentication gate, CSRF validation, or restriction to CLI or localhost context. The endpoint sequentially executes predefined patch routines that include DDL operations (ALTER TABLE, DROP TABLE), DML mutations (UPDATE, DELETE), configuration file rewrites, filesystem renames and deletions, and cache invalidation. Patch 53 specifically performs batch token regeneration for every admin and client account and invalidates all active sessions - disruptive even when re-applied to an already-patched instance. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero prerequisites for network exploitation. No specific CPE strings were provided in source data, but the product is a PHP web application installable on standard LAMP/LEMP stacks.
Affected ProductsAI
FOSSBilling versions 0.5.4 through 0.7.2 are confirmed affected per GitHub Security Advisory GHSA-prx6-m547-rfmg (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-prx6-m547-rfmg). The vulnerability is present in all default installations within this version range that expose the web interface over the network. No CPE strings were included in the source data. Version 0.8.0 is the first unaffected release, available at https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0.
RemediationAI
Upgrade to FOSSBilling 0.8.0, released 2026-05-28, which resolves this vulnerability along with several other security issues including hardened session and cookie handling and rate-limit improvements. The release is available at https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0. Before upgrading, back up the database and files - version 0.8.0 includes breaking changes: PHP 8.3 is now required, guest API routes have been refactored, and custom modules or themes may need updates. If immediate upgrade is not possible, block external access to the /run-patcher route at the web server layer (nginx location block with deny all, or Apache Require all denied directive for that path); this prevents exploitation but also prevents the legitimate post-upgrade patch runner from executing via HTTP, requiring a CLI-based alternative or temporary allow-listing of trusted IPs. The GitHub security advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-prx6-m547-rfmg should be monitored for additional guidance.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today