Executive brief
FOSSBilling is an automated billing and client management platform for online businesses. A security flaw allows a logged-in customer to link their support tickets to orders belonging to other customers. This could mislead staff into performing unauthorized actions, such as canceling or upgrading the wrong person's service, potentially disrupting operations or causing financial discrepancies.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the FOSSBilling support ticket creation workflow. The `ticketCreateForClient()` method fails to verify order ownership when the `rel_type` parameter is set to 'order' for non-upgrade tasks. By manipulating the `rel_id` parameter in a crafted request, an authenticated client can associate a new support ticket with any valid order ID in the system. While this does not directly expose sensitive order data to the attacker, it allows them to submit requests (like cancellations) that appear to be linked to another client's account, potentially tricking administrative staff into acting on the wrong order. The issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling >= 0.6.21, < 0.8.0
Timeline
- 2026-05-28: patched: Version 0.8.0 released
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD