PT-2026-52090 · Fossbilling · Fossbilling

Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-33543

Mitre

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already exists. The flawed guard check uses is countable() on a value that returns a Model Admin object or null rather than a countable type, causing the expression to always evaluate as true and bypass the intended protection. As a result, an attacker can reach the unprotected endpoint to create a new administrator account and immediately authenticate, gaining a fully privileged admin session even when an admin already exists. This issue has been fixed in version 0.8.0.

Fix

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2026-33543

Affected Products

Fossbilling

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33543 · Security Note
• https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 · Note
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-28mh-j262-q49w · Note