EUVD-2026-41962Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable registration endpoint, no auth required; impact is limited integrity only (group field injection), with no confidentiality or availability effect and unchanged scope.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).
AnalysisAI
Unauthenticated mass assignment in FOSSBilling's client self-registration endpoint (all versions prior to 0.8.0) allows any visitor to inject an arbitrary client group identifier during signup, bypassing group-based access controls on promotional codes. Attackers who successfully place themselves into a privileged group can redeem group-restricted discount codes and receive unauthorized price reductions. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 6.9 reflects a limited, integrity-only impact with no confidentiality or availability consequence, and the erroneous 'RCE' source tag should be disregarded as inconsistent with the description and impact metrics.
Technical ContextAI
CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) describes classic mass assignment, where user-supplied request parameters are bound directly to server-side model attributes without an explicit allowlist. In FOSSBilling's self-registration flow, the endpoint responsible for creating new client accounts fails to restrict the set of assignable fields, permitting a caller to submit a client group identifier (e.g., client_group_id or equivalent) as part of the registration payload. FOSSBilling uses client groups to gate promotional code eligibility, meaning control over group membership translates directly into the ability to unlock restricted discount tiers. No CPE strings were provided, but the affected software is the open-source FOSSBilling billing and client management platform across all releases preceding version 0.8.0.
RemediationAI
Upgrade to FOSSBilling version 0.8.0, which contains the vendor-confirmed patch for this mass assignment vulnerability; the advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-q4rq-9844-r9w2 should be consulted for release details. If an immediate upgrade is not feasible, two vendor-documented workarounds are available: first, administrators can remove group restrictions from all promotional codes via the admin panel, which eliminates the exploitable business impact but has the trade-off of making those codes accessible to all client tiers; second, administrators can disable client self-registration entirely under Settings → Clients → Disable signup, which closes the vulnerable endpoint entirely but blocks all new self-service account creation and requires manual provisioning of new clients.
Share
External POC / Exploit Code
Leaving vuln.today