Executive brief
FOSSBilling, an open-source billing and client management platform, contains a flaw where user sessions remain active even after an account has been suspended or deactivated. This means a terminated employee or a suspended customer could continue to access sensitive financial data, manage orders, or perform administrative actions until their login session naturally expires. The issue also affects API tokens and password reset flows, potentially allowing unauthorized access to persist indefinitely.
Technical details
A session management vulnerability exists in FOSSBilling due to insufficient validation in the session identity loaders within 'src/di.php'. Specifically, the 'loggedin_client' and 'loggedin_admin' functions only verify if an account record exists in the database but fail to check the 'status' field (e.g., active, suspended, or canceled). Consequently, existing authenticated sessions remain valid after an administrative status change. Furthermore, the API token authentication path and password reset flows in 'Client/Api/Guest.php' and 'Staff/Api/Guest.php' do not filter by account status. An attacker with an existing session or API token can maintain full privileges until the session expires. This issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling >= 0.1.0, <= 0.7.2
Timeline
- 2026-05-28: patched: Version 0.8.0 released
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD