EUVD-2026-39052Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-facing API with a low-privilege client account (PR:L), no user interaction, trivial complexity; impact is read-only PII disclosure so C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an order_id parameter and fetches the associated order without verifying the authenticated client owns it, potentially exposing cross-client data through IDOR. An authenticated client can access any other client's custom service by guessing sequential order IDs. This can lead to a confidentiality breach - attackers can read client PII (name, email, phone, address, company details, VAT number) and service configuration data belonging to other clients. This issue has been fixed in version 0.8.0.
AnalysisAI
Insecure direct object reference (IDOR) in FOSSBilling's Servicecustom Client API (versions 0.7.2 and prior) lets any authenticated client retrieve another client's custom service records by supplying a guessed sequential order_id, because the __call method fetches the order without an ownership check. The exposed data includes other clients' PII (name, email, phone, address, company details, VAT number) and service configuration, making this a cross-tenant confidentiality breach. No public exploit identified at time of analysis, and the issue is resolved in version 0.8.0.
Technical ContextAI
FOSSBilling is an open-source PHP billing and client-management platform whose modules expose functionality through a magic __call dispatcher on their API classes. The vulnerable Servicecustom Client API accepts an order_id and loads the corresponding order object, but performs authorization only at the 'is logged in as a client' layer rather than verifying that the requesting client owns the referenced order. This is a classic missing object-level authorization flaw; NVD classifies it under CWE-284 (Improper Access Control), though the behavior is more precisely an IDOR/CWE-639 (Authorization Bypass Through User-Controlled Key). Because order IDs are sequential integers, the missing check turns an internal identifier into an enumeration primitive. The affected component is identified by CPE cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:* across all versions up to and including 0.7.2.
RemediationAI
Vendor-released patch: 0.8.0 - upgrade FOSSBilling to 0.8.0 or later (https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0), reviewing the advisory at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-p36w-9x66-488j first. Note that 0.8.0 is a larger release with breaking changes: it requires PHP 8.3+, refactors guest API routes, removes the Paidsupport and Servicemembership modules, reworks Box_Mod into FOSSBilling\Module, and changes the frontend build system, so back up the installation and test custom modules, themes, and API integrations before upgrading. If immediate upgrade is not possible, compensating controls are limited because the flaw is in core authorization logic: restrict or disable new client self-registration to prevent untrusted attackers from obtaining the required low-privilege account (trade-off: blocks legitimate onboarding), restrict access to the Servicecustom API endpoint at the web-server or WAF layer to known/trusted clients, and monitor application/audit logs for clients requesting order_id values they do not own (trade-off: detective, not preventive). These are stopgaps only; the supported fix is upgrading to 0.8.0.
More in Fossbilling
View allSQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated critical severity (CVSS 9.8), this vuln
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated high
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated high severity (CVSS 7.5), this
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated high severity (CVSS 7.2), this vulnera
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 6.5), thi
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. Rated medium severit
Authorization bypass in FOSSBilling versions 0.5.4 through 0.7.x allows unauthenticated remote attackers to invoke privi
Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. Rated critical severity (CV
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 5.7), thi
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium sev
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated medium severity (CVSS 5.4), this vul
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today