FOSSBilling CVE-2026-53645
HIGHVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Persistent privilege escalation in FOSSBilling versions prior to 0.8.0 lets a low-privileged staff account holding only the staff.create_and_edit_staff permission promote itself to arbitrary permissions via the admin API, defeating role-based access control. By calling /api/admin/staff/permissions_update against its own account, the staff user writes any permission structure and effectively gains full administrative control. Rated CVSS 4.0 8.5 (High); no public exploit identified at time of analysis and it is not listed in CISA KEV, but the attack is trivially reproducible once a qualifying staff account exists.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has staff.create_and_edit_staff can call /api/admin/staff/permissions_update targeting their own account and write any permission structure, bypassing the intended role-based access control boundary. Version 0.8.0 patches the issue. Some workarounds are available. Restrict the staff.create_and_edit_staff permission to only highly trusted staff members and/or use a reverse proxy or WAF to restrict access to /api/admin/staff/permissions_update to specific trusted roles.
Executive ViewAI
FOSSBilling versions prior to 0.8.0 contain a privilege escalation vulnerability enabling authenticated staff users to grant themselves full administrative access through the admin API. Organizations using affected versions risk unauthorized control of billing systems and customer data by insiders with staff roles.
Within 24 hours: inventory all staff accounts with staff.create_and_edit_staff permission and disable any not actively required. Within 7 days: enable comprehensive audit logging on /api/admin/staff/permissions_update endpoint with alerting on permission modification attempts; document current permission baseline. Within 30 days: upgrade FOSSBilling to version 0.8.0 or later when released.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) apply principle of least privilege by revoking staff.create_and_edit_staff permission from accounts not requiring it, (2) implement and monitor API audit logs with alerting for staff permission modifications, (3) restrict /api/admin/staff endpoint access to administrative network segments only, (4) conduct monthly staff permission audits to detect unauthorized privilege escalation, (5) require administrative approval workflow for all staff permission grants.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB