PT-2026-51591 · Fossbilling · Fossbilling

Enigmaticious · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-23513

Mitre

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In ServiceTransaction::getSearchQuery() and OrderService::getSearchQuery(), OR-based search/action filters were appended without grouping, allowing SQL operator precedence to evaluate OR clauses independently of the enforced client id constraint. Crafted requests could therefore return records and metadata belonging to other clients, including identifiers, amounts, status, timestamps, and related fields. This issue was fixed in version 0.8.0.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-23513

Affected Products

Fossbilling

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-23513 · Security Note
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-xcrv-cccw-r65v · Note
• https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 · Note