EUVD-2026-41947Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint (AV:N/PR:N) but requires knowledge of a secret invoice hash and enabled hash access, so AC:H; only limited integrity impact to one unpaid invoice's gateway (I:L), no confidentiality or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge of an invoice hash to modify the payment gateway associated with an unpaid invoice. An attacker who obtains an invoice hash, which may leak through shared URLs, referrer headers, or email links, can change the gateway_id on an unpaid invoice to any payment gateway configured in the system. This does not allow redirecting payments to an arbitrary external endpoint, as the gateway must already be installed and configured by an administrator. The practical impact is further limited by the invoice_accessible_from_hash system setting. Version 0.8.0 contains a patch. No known workarounds are available.
AnalysisAI
Broken access control in FOSSBilling before 0.8.0 lets an unauthenticated attacker who knows an unpaid invoice's hash change the payment gateway (gateway_id) tied to that invoice, because the Guest API invoice/update endpoint omits an authorization check that its sibling invoice endpoints enforce. The attacker can only select gateways an administrator has already installed and configured, and the impact is further gated by the invoice_accessible_from_hash setting, so it cannot redirect funds to an arbitrary external endpoint. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
FOSSBilling is a PHP-based open-source billing and client-management platform whose Guest API exposes invoice operations to unauthenticated visitors keyed by a per-invoice hash token. The root cause is CWE-306 (Missing Authentication for a Critical Function): the invoice/update handler was shipped without the authorization guard that the other invoice-related endpoints apply, so any caller presenting a valid hash is treated as authorized to mutate the invoice's gateway_id. The affected component is the fossbilling/fossbilling application itself (cpe:2.3:a:fossbilling:fossbilling), and exploitation hinges on the invoice hash - a bearer-style secret that can leak through shared URLs, HTTP Referer headers, or email links - plus whether hash-based invoice access is enabled via the invoice_accessible_from_hash system setting.
RemediationAI
Upgrade to FOSSBilling 0.8.0, which adds the missing authorization check on the Guest API invoice/update endpoint; the vendor states no workarounds are available (Vendor-released patch: 0.8.0, per GHSA-8755-w77f-3g7j at https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-8755-w77f-3g7j). If patching must be delayed, reduce exposure by disabling the invoice_accessible_from_hash system setting so invoices cannot be reached by hash alone - noting the trade-off that legitimate customers relying on hash-based invoice links (for example from emailed pay links) will lose that convenience and may need authenticated access. Additionally, treat invoice hashes as secrets: avoid embedding them in URLs that generate Referer leakage and limit their distribution, since hash disclosure is the practical precondition for abuse.
More in Fossbilling
View allSQL Injection in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated critical severity (CVSS 9.8), this vuln
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Unrestricted Upload of File with Dangerous Type in GitHub repository fossbilling/fossbilling prior to 0.5.3. Rated high
Missing Authorization in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated high severity (CVSS 7.5), this
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated high severity (CVSS 7.2), this vulnera
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 6.5), thi
Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. Rated medium severit
Authorization bypass in FOSSBilling versions 0.5.4 through 0.7.x allows unauthenticated remote attackers to invoke privi
Insufficient Session Expiration in GitHub repository fossbilling/fossbilling prior to 0.5.5. Rated critical severity (CV
Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium severity (CVSS 5.7), thi
Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0. Rated medium sev
Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1. Rated medium severity (CVSS 5.4), this vul
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today