Executive brief
FOSSBilling is an open-source platform used by businesses to manage client billing and automated service provisioning. A flaw in the checkout process allows customers to bypass limits on promotional codes by submitting multiple purchase requests simultaneously. This could result in significant financial loss as users can obtain unlimited discounts or free products using codes intended for single or limited use.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in 'src/modules/Cart/Service.php'. The 'checkoutCart()' function performs a non-atomic check of the '$promo->used' counter against '$promo->maxuses' before incrementing the value. Because there is no database-level locking (e.g., SELECT FOR UPDATE) or transaction wrapping the check-and-increment sequence, an attacker can send multiple concurrent network requests that all pass the validation check before the first increment is committed. This allows for the unauthorized application of discounts beyond their intended limit. The issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling < 0.8.0
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: CVE published to NVD
- 2026-08-01: patched: Fixed in version 0.8.0