PT-2026-52076 · Fossbilling · Fossbilling

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-27708

NVD

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's call method accepts an order id parameter and fetches the associated order without verifying the authenticated client owns it, potentially exposing cross-client data through IDOR. An authenticated client can access any other client's custom service by guessing sequential order IDs. This can lead to a confidentiality breach — attackers can read client PII (name, email, phone, address, company details, VAT number) and service configuration data belonging to other clients. This issue has been fixed in version 0.8.0.

Fix

IDOR

Missing Authorization

Improper Access Control

Weakness Enumeration

CWE-639

CWE-862

CWE-284

Related Identifiers

CVE-2026-27708

Affected Products

Fossbilling

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-27708 · Security Note
• https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 · Note
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-p36w-9x66-488j · Note