Which versions of FOSSBilling are affected by CVE-2026-53645?

FOSSBilling versions prior to 0.8.0 contain a privilege escalation vulnerability enabling authenticated staff users to grant themselves full administrative access through the admin API.

How to fix or mitigate CVE-2026-53645?

Within 24 hours: inventory all staff accounts with staff.create_and_edit_staff permission and disable any not actively required. Within 7 days: enable comprehensive audit logging on /api/admin/staff/permissions_update endpoint with alerting on permission modification attempts; document current permission baseline. Within 30 days: upgrade FOSSBilling to version 0.8.0 or later when released.

FOSSBilling CVE-2026-53645

Q: What is the CVSS score of CVE-2026-53645?

CVE-2026-53645 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Improper Privilege Management (CWE-269)

2026-07-06 security-advisories@github.com

Privilege Escalation

8.5

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 23:36 vuln.today

DescriptionCVE.org

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has staff.create_and_edit_staff can call /api/admin/staff/permissions_update targeting their own account and write any permission structure, bypassing the intended role-based access control boundary. Version 0.8.0 patches the issue. Some workarounds are available. Restrict the staff.create_and_edit_staff permission to only highly trusted staff members and/or use a reverse proxy or WAF to restrict access to /api/admin/staff/permissions_update to specific trusted roles.

AnalysisAI

Persistent privilege escalation in FOSSBilling versions prior to 0.8.0 lets a low-privileged staff account holding only the staff.create_and_edit_staff permission promote itself to arbitrary permissions via the admin API, defeating role-based access control. By calling /api/admin/staff/permissions_update against its own account, the staff user writes any permission structure and effectively gains full administrative control. Rated CVSS 4.0 8.5 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV, but the attack is trivially reproducible once a qualifying staff account exists.