PT-2026-51521 · Fossbilling · Fossbilling

Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-27604

NVD

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged /api/system/* endpoints. Because system resolves to the cron admin identity, attackers can invoke admin API methods without valid credentials, session, or CSRF token. Version 0.8.0 patches the issue. Some workarounds are available. Block external access to /api/system/* at reverse proxy/WAF, restrict API access by trusted source IPs only (api.allowed ips), rotate all admin/client API tokens immediately, invalidate active sessions and reset high-privilege credentials, and/or review API request logs for suspicious /api/system/ access and treat as potential incident.

Fix

Incorrect Authorization

Information Disclosure

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-863

CWE-200

CWE-306

CWE-862

Related Identifiers

CVE-2026-27604

Affected Products

Fossbilling

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-27604 · Security Note
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-78x5-c8gw-8279 · Note
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc · Note
• https://vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce · Note