CVE-2026-111056
Deferred Deferred - Pending Action

Information Disclosure in FOSSBilling Guest Signup API

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: GitHub, Inc.

Description
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-111056
EUVD
EUVD-2026-104418

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FOSSBilling FOSSBilling >= 0.1.0, < 0.8.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FOSSBilling allows unauthenticated attackers to check if an email address is registered by submitting it to the guest signup endpoint. The API returns a distinct error for existing emails, revealing whether the email belongs to a registered client.

Detection Guidance

To detect this vulnerability, send unauthenticated POST requests to /api/guest/client/create with target email addresses and observe the response. If the response contains 'This email address is already registered' for existing emails or a client ID for new ones, the system is vulnerable. Use tools like curl to automate testing: curl -X POST -H 'Content-Type: application/json' -d '{"email":"test@example.com"}' https://your-fossbilling/api/guest/client/create

Check FOSSBilling logs for repeated guest signup attempts from the same IP or email, which may indicate exploitation attempts. Monitor for unusual timing patterns in responses as attackers may probe for email existence.

Impact Analysis

Attackers can use this to enumerate registered email addresses, enabling targeted phishing, password reset spam, or harassment. Hosted operators may expose sensitive customer lists. The vulnerability allows low-effort email enumeration despite rate limiting.

Mitigation Strategies

Upgrade FOSSBilling to version 0.8.7 or later immediately to patch the vulnerability. If upgrading is not possible, disable public self-service signup via the 'Disable New Signups' toggle in the admin panel.

Configure a reverse proxy or WAF to enforce strict rate limiting based on email addresses (e.g., 5 requests per hour per email). Implement CAPTCHA validation for all guest signup attempts to prevent automated enumeration.

Monitor API logs for suspicious activity, such as repeated signup attempts from the same IP or email. Consider adding randomized delays to API responses to obscure timing-based attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart