Is CVE-2026-111046 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111046 being exploited in the wild.

How severe is CVE-2026-111046?

Informational severity, published 19 October 2026.

How is CVE-2026-111046 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111046?

Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111046: FOSSBilling authorization bypass in extension configuration management

CVE-2026-111046 · Severity: info · Published 2026-10-19

FOSSBilling is an open-source billing and client-management platform that handles customer and service management. A low-privileged staff member can read decrypted secrets and modify the configuration of deactivated extension modules by exploiting a permission bypass in the extension configuration API. This allows attackers to access sensitive stored credentials and change how disabled modules behave without proper authorization checks.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-111046 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111046 being exploited in the wild.
How severe is CVE-2026-111046?: Informational severity, published 19 October 2026.
Which products and versions are affected?: FOSSBilling 0.8.4 to 0.8.5.
Is there a fix for CVE-2026-111046?: Yes: fixed in 0.8.6. Until then: Restrict API access to the extension/config_get and extension/config_save endpoints to only highly-privileged administrative accounts until upgrading to version 0.8.6.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-19"},{"kind":"patched","at":"2026-08-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111046 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111046?: Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.8.6

Restrict API access to the extension/config_get and extension/config_save endpoints to only highly-privileged administrative accounts until upgrading to version 0.8.6.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-19"},{"kind":"patched","at":"2026-08-23"}]

Technical details

The hasManagePermission function fails open for inactive non-core modules because an early return on !isExtensionActive skips subsequent module-access and manage_settings permission checks. A staff account with module-level extension access can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated module, allowing the getConfig function to return decrypted stored configuration despite the module's inactive state. This is a regression in authorization logic that bypasses permission validation through a path not covered by earlier CVE-2026-62962 fixes.

Affected products

FOSSBilling FOSSBilling 0.8.4 to 0.8.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.