FOSSBilling CVE-2026-53647
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
A valid API key is required to retrieve record data, warranting PR:L over the vendor's PR:N; confidentiality impact is limited to custom_ fields only, with no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest serviceapikey/get_info API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (custom_* fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. Version 0.8.0 patches the issue. Some workarounds are available. Administrators can avoid storing sensitive data in custom_* API key configuration fields, monitor API logs for suspicious calls to /api/guest/serviceapikey/get_info, and/or disable the Serviceapikey module if not in active use.
AnalysisAI
Unauthenticated information disclosure in FOSSBilling 0.5.3-0.7.2 exposes administrator-defined custom API key configuration fields (custom_*) to any caller possessing a valid API key via the guest-tier serviceapikey/get_info endpoint. The affected fields may contain business-sensitive operational data including pricing tiers, feature flags, rate limits, expiry overrides, and access scope data as populated by billing administrators. No public exploit has been identified and no CISA KEV listing exists, but the network-accessible, low-complexity nature of the flaw makes it trivially exploitable by any party holding or able to obtain a valid API key. Vendor patch is confirmed available in version 0.8.0.
Technical ContextAI
FOSSBilling is a PHP-based open-source billing and client management platform. The vulnerability exists within its Serviceapikey module, specifically the /api/guest/serviceapikey/get_info endpoint, which is registered under the guest (unauthenticated) API tier. In FOSSBilling's architecture, guest endpoints are designed to be publicly callable, but this endpoint returns the full database record for the supplied API key - including all administrator-defined custom_* key-value fields - without any authorization check to verify whether the caller is entitled to view that metadata. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) precisely characterizes the root cause: the application sends data to the actor that the actor should not have access to, due to a missing access control check on sensitive fields within an otherwise accessible response. No CPE strings were provided in the source data; affected versions are 0.5.3 through 0.7.2 per the GitHub Security Advisory GHSA-737q-9gpr-6mpq.
Affected ProductsAI
FOSSBilling versions 0.5.3 through 0.7.2 are confirmed affected per the vendor GitHub Security Advisory GHSA-737q-9gpr-6mpq (https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-737q-9gpr-6mpq). Version 0.8.0 is confirmed as the patched release. No CPE strings were included in the available intelligence data. The vulnerability is specific to the Serviceapikey module; installations where this module is disabled are not exposed.
RemediationAI
Upgrade to FOSSBilling 0.8.0, which patches this issue per the vendor advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-737q-9gpr-6mpq. If immediate upgrade is not feasible, three compensating controls are available with distinct trade-offs. First, audit and remove any sensitive data currently stored in custom_* API key configuration fields - this eliminates the exposure without requiring a code change but requires an operational review of all issued keys. Second, enable API access logging and monitor for calls to /api/guest/serviceapikey/get_info from unexpected sources; this is detective rather than preventive and does not stop data exposure. Third, disable the Serviceapikey module entirely if it is not actively used - this eliminates the attack surface completely but disables the module's billing functionality. The vendor-released patch in 0.8.0 is the only confirmed remediation.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today