FOSSBilling CVE-2026-53643
HIGHSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable admin API needing an authenticated low-priv staff account (PR:L, AC:L); CWE-200 drives C:H, with limited integrity from 'unauthorized actions' (I:L) and no clear availability impact (A:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the can_always_access module flag (which grants all staff access to certain modules) and insufficient permission checks or unsafe parameter handling on individual endpoints. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive settings and/or use a reverse proxy or WAF to restrict access to the affected endpoints to trusted IP addresses or higher-privilege roles.
AnalysisAI
Privilege escalation and unauthorized access in FOSSBilling before 0.8.0 lets authenticated low-privileged staff accounts invoke admin API endpoints they should not reach, exposing sensitive data and enabling actions reserved for higher-privilege roles. The flaw stems from the framework-level can_always_access module flag combined with weak per-endpoint permission checks, so any staff login becomes a stepping stone to sensitive settings. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the GitHub Security Advisory rates it CVSS 4.0 8.7 (High).
Technical ContextAI
FOSSBilling is a PHP-based open-source billing and client management platform whose admin functionality is exposed through modular API endpoints. Individual modules can be marked with a can_always_access flag, which grants every staff account access to that module regardless of their assigned role or permission set. When such modules also perform insufficient authorization checks or unsafely trust request parameters on specific endpoints, the intended per-role access control is bypassed. This maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the root cause is a broken authorization boundary where a coarse always-access grant plus missing fine-grained checks lets a low-privilege identity read or manipulate data belonging to more privileged functions.
Affected ProductsAI
FOSSBilling, the free open-source billing and client management system, in all versions prior to 0.8.0. No CPE string was provided in the input. The authoritative source is the vendor's GitHub Security Advisory GHSA-563q-g4r4-6f9m (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-563q-g4r4-6f9m); the NVD reference points to the same advisory. Version 0.8.0 and later contain the fix.
RemediationAI
Upgrade to FOSSBilling 0.8.0, which contains the official fix - Vendor-released patch: 0.8.0. Where an immediate upgrade is not possible, the vendor-suggested workarounds are to restrict staff accounts strictly to personnel who genuinely need access to sensitive settings (reducing the number of low-privilege identities that could abuse the flaw), and to place a reverse proxy or WAF in front of the application to limit access to the affected admin API endpoints to trusted source IP addresses or higher-privilege roles; the trade-off is that IP/role gating adds operational overhead and can block legitimate remote staff or automation if not scoped carefully. Consult the advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-563q-g4r4-6f9m for details, and review staff account roles and audit logs after patching.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today