EUVD-2026-38613Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable client endpoint (AV:N), no special timing (AC:L), requires a low-privileged client login (PR:L), no user interaction, confidentiality-only cross-tenant data leak so C:H and I/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In ServiceTransaction::getSearchQuery() and Order\Service::getSearchQuery(), OR-based search/action filters were appended without grouping, allowing SQL operator precedence to evaluate OR clauses independently of the enforced client_id constraint. Crafted requests could therefore return records and metadata belonging to other clients, including identifiers, amounts, status, timestamps, and related fields. This issue was fixed in version 0.8.0.
AnalysisAI
Cross-tenant data exposure in FOSSBilling 0.7.2 and earlier lets authenticated client users retrieve transaction and order records belonging to other clients by abusing SQL operator precedence in list-endpoint search queries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the low complexity and low-privilege requirement make it a meaningful confidentiality risk for multi-tenant deployments. The flaw was remediated in version 0.8.0 released 2026-05-28.
Technical ContextAI
FOSSBilling is a PHP-based open-source billing and client-management platform (CPE cpe:2.3:a:fossbilling:fossbilling). The root cause is CWE-863 (Incorrect Authorization) manifested as a SQL query-construction defect: in ServiceTransaction::getSearchQuery() and Order\Service::getSearchQuery(), OR-based search/action filters were concatenated into the WHERE clause without being wrapped in parentheses. Because SQL evaluates AND before OR, the enforced 'client_id = X' tenant constraint became one disjunct rather than a mandatory predicate, so any OR-side filter match would satisfy the query regardless of ownership. This is a classic insufficient-grouping authorization bypass at the data-access layer rather than a missing-check at the controller layer.
RemediationAI
Vendor-released patch: FOSSBilling 0.8.0 (released 2026-05-28) - upgrade per https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 and the advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-xcrv-cccw-r65v. Note that 0.8.0 introduces breaking changes including a PHP 8.3 minimum requirement, refactored guest API routes, removal of Paidsupport and Servicemembership modules, the Box_Mod to FOSSBilling\Module rename, and a Webpack-to-esbuild frontend build switch, so custom modules, themes, and API integrations may need updates and a staging-environment validation before production rollout. If immediate upgrade is not feasible, compensating controls are limited because the flaw lives in core query construction - temporarily disabling client self-service access to the transactions and orders list endpoints (for example via web-server rules blocking the affected client-area URLs) reduces exposure at the cost of breaking legitimate client visibility into their own billing history, and tightening client signup (disabling open registration, requiring manual approval) shrinks the population of accounts that can stage the attack.
More in Fossbilling
View allSQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated critical severity (CVSS 9.8), this vuln
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated high
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated high severity (CVSS 7.5), this
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated high severity (CVSS 7.2), this vulnera
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 6.5), thi
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. Rated medium severit
Authorization bypass in FOSSBilling versions 0.5.4 through 0.7.x allows unauthenticated remote attackers to invoke privi
Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. Rated critical severity (CV
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 5.7), thi
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium sev
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated medium severity (CVSS 5.4), this vul
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today