CVE-2026-53643

Received Received - Intake

Privilege Escalation in FOSSBilling via Admin API

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: GitHub, Inc.

Description

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_always_access` module flag (which grants all staff access to certain modules) and insufficient permission checks or unsafe parameter handling on individual endpoints. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive settings and/or use a reverse proxy or WAF to restrict access to the affected endpoints to trusted IP addresses or higher-privilege roles.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-53643

Affected Vendors & Products

Vendor	Product	Version / Range
fossbilling	fossbilling	to 0.8.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects FOSSBilling versions prior to 0.8.0. It allows low-privileged staff accounts to perform unauthorized actions through admin API endpoints. The issue arises because the 'can_always_access' module flag grants all staff access to certain modules, combined with insufficient permission checks or unsafe parameter handling on individual endpoints.

Version 0.8.0 of FOSSBilling contains a fix for this vulnerability.

Workarounds include restricting staff accounts to only those who need access to sensitive settings and using a reverse proxy or WAF to limit access to affected endpoints to trusted IP addresses or higher-privilege roles.

Impact Analysis

This vulnerability can allow low-privileged staff members to perform unauthorized administrative actions, potentially leading to unauthorized changes or access within the billing and client management system.

Such unauthorized actions could compromise the integrity and confidentiality of billing data and client information.

Mitigation Strategies

To mitigate this vulnerability, you should restrict staff accounts to only those who need access to sensitive settings.

Additionally, use a reverse proxy or Web Application Firewall (WAF) to restrict access to the affected admin API endpoints to trusted IP addresses or higher-privilege roles.

Upgrading to FOSSBilling version 0.8.0 or later is recommended, as it contains a fix for this issue.

Hi! I’m here to help you understand CVE-2026-53643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70