CVE-2026-53640

Received Received - Intake

Unauthorized Data Exposure in FOSSBilling via Missing API Permissions

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admin API endpoints that lack permission checks. While sibling write endpoints correctly enforce fine-grained permissions, the corresponding read endpoints have no authorization guards. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive data and/or use a reverse proxy or WAF to restrict access to the affected endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-53640

Affected Vendors & Products

Vendor	Product	Version / Range
fossbilling	fossbilling	to 0.8.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects FOSSBilling, an open-source billing and client management system. Before version 0.8.0, low-privileged staff accounts could read sensitive data through admin API endpoints that did not have proper permission checks. While write endpoints enforced permissions correctly, the read endpoints lacked authorization guards, allowing unauthorized access to sensitive information.

Impact Analysis

The vulnerability allows low-privileged staff accounts to access sensitive data they should not be able to see. This unauthorized data exposure could lead to information leakage, potentially compromising client or billing information managed by FOSSBilling.

Mitigation Strategies

To mitigate this vulnerability, you should restrict staff accounts to only those who need access to sensitive data.

Additionally, you can use a reverse proxy or a Web Application Firewall (WAF) to restrict access to the affected admin API read endpoints that lack permission checks.

Upgrading to FOSSBilling version 0.8.0 or later is recommended, as this version contains a fix for the issue.

Compliance Impact

This vulnerability allows low-privileged staff accounts to read sensitive data via admin API endpoints that lack permission checks. Such unauthorized access to sensitive data could potentially lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive information.

However, the CVE description does not explicitly mention compliance impacts or regulatory considerations.

Hi! I’m here to help you understand CVE-2026-53640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70