Riskcovery

CVE-2026-53640

FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data

State
Published
Severity
2.3 Low
Published
Jul 6, 2026
Updated
Jul 7, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admin API endpoints that lack permission checks. While sibling write endpoints correctly enforce fine-grained permissions, the corresponding read endpoints have no authorization guards. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive data and/or use a reverse proxy or WAF to restrict access to the affected endpoints.

Scores

CVSSScoreVectorSource
4.02.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-862 Missing Authorization

Affected Products

ProductVersions
FOSSBillingFOSSBilling
  • < 0.8.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.