PT-2026-52076 · Fossbilling · Fossbilling

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-27708

NVD

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's call method accepts an order id parameter and fetches the associated order without verifying the authenticated client owns it, potentially exposing cross-client data through IDOR. An authenticated client can access any other client's custom service by guessing sequential order IDs. This can lead to a confidentiality breach — attackers can read client PII (name, email, phone, address, company details, VAT number) and service configuration data belonging to other clients. This issue has been fixed in version 0.8.0.

Correção

IDOR

Missing Authorization

Improper Access Control

Enumeração de Fraquezas

CWE-639

CWE-862

CWE-284

Identificadores relacionados

CVE-2026-27708

Produtos afetados

Fossbilling

Referências · 3

• https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 · Nota
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-p36w-9x66-488j · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27708 · Nota de Segurança