CVE-2026-116257
Received Received - Intake

Authentication Bypass in BillaBear Installation Handler

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116257
EUVD
EUVD-2026-109730

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a BillaBear 2025.01.03

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated administrator account creation flaw in BillaBear, a billing and subscription platform. It allows attackers to exploit the installation process by creating a fully privileged admin account without authentication during the deployment window between first boot and setup completion. The issue occurs because the /install/process endpoint lacks authentication and an installed-state check.

Detection Guidance

Check for unauthorized administrator accounts in BillaBear by inspecting the database for unexpected ROLE_ADMIN entries. Monitor network traffic for POST requests to /install/process during deployment windows. Verify if the settings table exists in the database, as its absence may indicate vulnerability exposure.

Impact Analysis

An attacker could gain full control of the BillaBear platform by creating an admin account. This would allow access to customer personally identifiable information (PII), subscriptions, and payment records. The attack is limited to PostgreSQL environments and only possible during the initial setup window before the platform is fully installed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive customer data, violating GDPR and HIPAA compliance requirements. It may result in data breaches exposing personal and financial information, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately add an installed-state check to the /install/process endpoint or protect all /install/* routes with an installer token. Ensure the settings table exists in the database to enforce the fail-closed mechanism. If using MySQL, migrate to PostgreSQL as the vulnerability does not affect MySQL environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart