Is CVE-2026-27708 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27708 being exploited in the wild.

How severe is CVE-2026-27708?

Informational severity, with a CVSS score of 7.1, published 24 June 2026.

Is there a fix for CVE-2026-27708?

A patch was published on 2026-05-28: Version 0.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27708 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-27708?

Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27708: FOSSBilling IDOR in Servicecustom Client API

CVE-2026-27708 · Severity: info · CVSS 7.1 · Published 2026-06-24

FOSSBilling is an open-source platform used by businesses to manage client billing and automated services. A security flaw allows a registered customer to view the private service details and personal information of other customers by guessing order numbers. This could lead to the exposure of sensitive data, including names, addresses, phone numbers, and service configurations, potentially damaging a company's reputation and violating data privacy regulations.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-27708 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27708 being exploited in the wild.
How severe is CVE-2026-27708?: Informational severity, with a CVSS score of 7.1, published 24 June 2026.
Which products and versions are affected?: FOSSBilling <= 0.7.2.
Is there a fix for CVE-2026-27708?: A patch was published on 2026-05-28: Version 0.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27708 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-27708?: Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `__call` method of the `Servicecustom` Client API. The root cause is located in `src/modules/Servicecustom/Service.php` within the `getServiceCustomByOrderId()` function, which fetches order data using `getExistingModelById` without verifying that the `client_id` associated with the order matches the authenticated user. Because order IDs are sequential, an authenticated attacker can iterate through IDs to retrieve cross-client data. This exposure includes PII such as names, emails, addresses, and VAT numbers, as well as specific service configurations. The issue is addressed in version 0.8.0 by implementing proper ownership validation.

Affected products

FOSSBilling FOSSBilling <= 0.7.2

Timeline

2026-05-28: patched: Version 0.8.0 released
2026-06-12: advisory: GitHub Security Advisory published
2026-06-24: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.