PT-2026-56042 · Fossbilling · Fossbilling
7Megaumka7
·
Publicado
2026-07-06
·
Atualizado
2026-07-07
·
CVE-2026-53647
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest
serviceapikey/get info API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (custom * fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. Version 0.8.0 patches the issue. Some workarounds are available. Administrators can avoid storing sensitive data in custom * API key configuration fields, monitor API logs for suspicious calls to /api/guest/serviceapikey/get info, and/or disable the Serviceapikey module if not in active use.Correção
Missing Authorization
Information Disclosure
Missing Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Fossbilling