FOSSBilling EUVD-2026-113897

Requires a FOSSBilling instance running a version before 0.8.9 whose guest staff login endpoint (POST /api/guest/staff/login) handled by checkGuestClientAuthentication() lacks CSRF/Origin validation because only client_login and client_create are allowlisted. The attacker must possess valid staff-account credentials on that same instance (the form submits attacker-controlled credentials), and a victim staff user must visit the attacker-controlled page so their browser auto-submits the form (UI:P). Limiting factors: this is login CSRF, so impact is confined to forcing the victim's browser into the attacker's session (VI:L; no confidentiality or availability impact), and realizing harm depends on the victim subsequently entering sensitive data or performing actions within that attacker-controlled session; instances on 0.8.9 or later, or custom forms correctly sending the pre-login same-origin session token, are not exploitable.

This is a moderate-severity login CSRF (CWE-352), not a top-priority emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) scores 5.1: network-reachable and low-complexity, but with only limited integrity impact (VI:L) and no confidentiality or availability impact, plus passive user interaction (UI:P) and PR:L. The signals are internally consistent and point to a bounded, lower-impact issue rather than a widespread exploitation threat: the Decision label is 'this_month' (not act_now/emergency), there is no CISA KEV listing, and no EPSS probability was supplied in the input, so widespread opportunistic exploitation cannot be quantified from the data provided. No confirmed public exploit code is listed - only vendor/VulnCheck advisories and the patch. The practical impact is session-fixation-style: a victim's browser is silently authenticated into the ATTACKER's staff account, meaning the attacker does not gain access to the victim's data but can trick the victim into operating within an account the attacker controls (phishing for data entry, capturing input). This is a real but lower-tier fix-this-cycle item.

An attacker who holds their own staff account on a target FOSSBilling instance (before 0.8.9) hosts a malicious web page containing an auto-submitting HTML form that POSTs the attacker's own credentials to /api/guest/staff/login. When a victim staff user visits the page, because staff_login is not covered by checkGuestClientAuthentication()'s CSRF/Origin allowlist, their browser is silently logged into the attacker's staff account, after which actions or data the victim enters occur inside the attacker-controlled session. No confirmed public exploit code is listed in the input (advisory and patch references only).