Executive brief
FOSSBilling, an open-source billing and client management platform, contains a critical security flaw that allows anyone to create a new administrator account without any existing credentials. By accessing a specific web address intended only for initial setup, an attacker can bypass security checks and gain full control over the system. This could lead to the theft of customer data, financial records, and complete disruption of the billing service.
Technical details
An authentication bypass exists in the `/api/guest/staff/create` endpoint of FOSSBilling due to a flawed logic check in `src/modules/Staff/Api/Guest.php`. The endpoint is intended for initial bootstrap but fails to properly verify if an administrator already exists. The check uses `is_countable()` on a `Model_Admin` object or `null` returned by the database; since these types are not countable, the expression `!is_countable(...)` always evaluates to true. This allows an unauthenticated remote attacker to trigger the `createAdmin()` and `login()` functions, resulting in a fully privileged administrative session. The vulnerability is patched in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling <= 0.7.2
Timeline
- 2026-05-28: patched: Version 0.8.0 released
- 2026-06-20: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE-2026-33543 published to NVD