Quick answers
- Is CVE-2026-43927 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-43927 being exploited in the wild.
- How severe is CVE-2026-43927?
- Informational severity, with a CVSS score of 6.9, published 6 July 2026.
- Which products and versions are affected?
- FOSSBilling < 0.8.0.
- Is there a fix for CVE-2026-43927?
- A patch was published on 2026-08-01: Fixed in version 0.8.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-43927 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-43927?
- Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in 'src/modules/Cart/Service.php'. The 'checkoutCart()' function performs a non-atomic check of the '$promo->used' counter against '$promo->maxuses' before incrementing the value. Because there is no database-level locking (e.g., SELECT FOR UPDATE) or transaction wrapping the check-and-increment sequence, an attacker can send multiple concurrent network requests that all pass the validation check before the first increment is committed. This allows for the unauthorized application of discounts beyond their intended limit. The issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling < 0.8.0
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD
- 2026-08-01: patched: Fixed in version 0.8.0