CVE-2026-111046
Deferred Deferred - Pending Action

Information Disclosure in FOSSBilling

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with module-level extension access targets a deactivated non-core module through extension/config_get or extension/config_save. The account can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated non-core module to read decrypted retained extension secrets and overwrite stored extension configuration. The getConfig function returns the decrypted stored configuration despite the module's inactive state. This residual path remained after the earlier CVE-2026-62962 authorization fix. This issue is fixed in version 0.8.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111046
EUVD
EUVD-2026-104415

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FOSSBilling FOSSBilling >= 0.8.4, < 0.8.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FOSSBilling (versions 0.8.4 to 0.8.6) allows low-privileged staff accounts with module-level extension access to read and modify configurations of deactivated non-core modules. The hasManagePermission function fails to enforce proper authorization checks for inactive modules, bypassing security controls while still permitting decryption and modification of their configurations.

Impact Analysis

An attacker with limited access could exploit this to read sensitive data like SMTP credentials, API keys, or payment-gateway settings stored in deactivated modules. They could also overwrite stored extension configurations, potentially altering system behavior or exposing confidential information.

Mitigation Strategies

Upgrade FOSSBilling to version 0.8.6 or later to address the vulnerability. Restrict extension permissions and clear sensitive configurations before deactivating modules to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart