Executive Summary

CVE-2026-43920 is a vulnerability in FOSSBilling versions 0.5.4 through 0.7.2 where the /run-patcher maintenance endpoint is accessible without authentication.

This endpoint allows unauthenticated remote users to trigger privileged maintenance operations such as modifying configuration files, executing database schema changes (including ALTER TABLE, DROP TABLE, and UPDATE statements), performing filesystem deletions and renames, and clearing caches.

Because these operations can be triggered by a simple HTTP GET request without requiring administrator authentication, CSRF validation, or CLI context, attackers can exploit this to cause denial-of-service attacks, inconsistent database states, or unauthorized modifications.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthenticated remote attackers to execute critical maintenance operations on your FOSSBilling system.

• Denial-of-service attacks by triggering disruptive patch routines repeatedly.
• Unauthorized modifications to configuration files and database schema, potentially corrupting or destabilizing your system.
• Filesystem mutations such as deletions and renames that could disrupt normal operations.
• Cache clearing that might affect system performance or behavior unexpectedly.
• Potential inconsistent database states caused by repeated or concurrent requests.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the /run-patcher endpoint is accessible without authentication on your FOSSBilling installation versions 0.5.4 through 0.7.2.

A simple way to test this is by sending an unauthenticated HTTP GET request to the /run-patcher endpoint and observing if it triggers maintenance operations.

For example, you can use the following command to test accessibility from a terminal:

• curl -v http://your-fossbilling-server/run-patcher

If the endpoint responds and triggers patch routines without requiring authentication, the system is vulnerable.

Additionally, monitoring web server logs for unexpected GET requests to /run-patcher can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include blocking external access to the /run-patcher endpoint at the web server level to prevent unauthenticated remote triggering of maintenance operations.

Alternatively, avoid using the /run-patcher web endpoint for applying database patches and instead apply patches via the command line interface (CLI), which requires proper authentication.

Ultimately, upgrading FOSSBilling to version 0.8.0 or later is recommended, as this version fixes the vulnerability by requiring authentication and improving security controls.

Before upgrading, review the release notes for potential breaking changes and back up your installation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated remote attackers to execute privileged maintenance operations that modify configuration files, database schemas, and filesystem contents without authentication. This can lead to unauthorized data modifications, potential denial-of-service, and inconsistent database states.

Such unauthorized access and potential data integrity issues could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require strict access controls, data integrity, and protection against unauthorized modifications.

However, the provided information does not explicitly mention compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0