Unknown · Magnusbilling · CVE-2025-52289
**Name of the Vulnerable Software and Affected Versions**
MagnusBilling version 7.8.5.3
**Description**
A broken access control issue in MagnusBilling version 7.8.5.3 allows newly registered users to gain escalated privileges. This is achieved by sending a crafted request to the `/mbilling/index.php/user/save` API endpoint to change their account status from "pending" to "active" without administrator approval.
**Recommendations**
MagnusBilling version 7.8.5.3: Restrict access to the `/mbilling/index.php/user/save` API endpoint to authorized personnel only.
MagnusBilling version 7.8.5.3: Implement stricter account status validation and require administrator approval for activating new user accounts.