PT-2026-51521 · Fossbilling · Fossbilling

Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-27604

NVD

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged /api/system/* endpoints. Because system resolves to the cron admin identity, attackers can invoke admin API methods without valid credentials, session, or CSRF token. Version 0.8.0 patches the issue. Some workarounds are available. Block external access to /api/system/* at reverse proxy/WAF, restrict API access by trusted source IPs only (api.allowed ips), rotate all admin/client API tokens immediately, invalidate active sessions and reset high-privilege credentials, and/or review API request logs for suspicious /api/system/ access and treat as potential incident.

Correção

Incorrect Authorization

Information Disclosure

Missing Authentication

Missing Authorization

Enumeração de Fraquezas

CWE-863

CWE-200

CWE-306

CWE-862

Identificadores relacionados

CVE-2026-27604

Produtos afetados

Fossbilling

Referências · 4

• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-78x5-c8gw-8279 · Nota
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27604 · Nota de Segurança
• https://vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce · Nota