CVE-2026-43918: FOSSBilling insufficient session expiration for suspended accounts

CVE-2026-43918 · Severity: info · CVSS 8.7 · Published 2026-07-06

FOSSBilling, an open-source billing and client management platform, contains a flaw where user sessions remain active even after an account has been suspended or deactivated. This means a terminated employee or a suspended customer could continue to access sensitive financial data, manage orders, or perform administrative actions until their login session naturally expires. The issue also affects API tokens and password reset flows, potentially allowing unauthorized access to persist indefinitely.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-43918 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43918 being exploited in the wild.
How severe is CVE-2026-43918?
Informational severity, with a CVSS score of 8.7, published 6 July 2026.
Which products and versions are affected?
FOSSBilling >= 0.1.0, <= 0.7.2.
Is there a fix for CVE-2026-43918?
A patch was published on 2026-05-28: Version 0.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43918 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43918?
Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A session management vulnerability exists in FOSSBilling due to insufficient validation in the session identity loaders within 'src/di.php'. Specifically, the 'loggedin_client' and 'loggedin_admin' functions only verify if an account record exists in the database but fail to check the 'status' field (e.g., active, suspended, or canceled). Consequently, existing authenticated sessions remain valid after an administrative status change. Furthermore, the API token authentication path and password reset flows in 'Client/Api/Guest.php' and 'Staff/Api/Guest.php' do not filter by account status. An attacker with an existing session or API token can maintain full privileges until the session expires. This issue is resolved in version 0.8.0.

Affected products

  • FOSSBilling FOSSBilling >= 0.1.0, <= 0.7.2

Timeline

  • 2026-05-28: patched: Version 0.8.0 released
  • 2026-06-12: advisory: GitHub Security Advisory published
  • 2026-07-06: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.