Executive brief
FOSSBilling is an open-source platform used by businesses to manage client billing and support services. A security flaw allows staff members with low-level access to view sensitive information they should not be able to see, such as client financial histories, administrator login logs, and internal system redirect rules. While these users cannot change the data, the exposed information could be used to plan further attacks or compromise privacy.
Technical details
FOSSBilling prior to version 0.8.0 suffers from missing authorization checks (CWE-862) in several read-only admin API endpoints. While the system implements a two-layer permission model, affected endpoints in the Staff, Client, and Redirect modules fail to call the second-layer checkPermissionsAndThrowException() function. An authenticated attacker with low-privileged staff credentials can exploit this over the network to retrieve administrator login history (including IP addresses), staff permission matrices, client balance transaction records, and system redirect rules. The vulnerability is resolved in version 0.8.0 by implementing the missing action-level authorization guards.
Affected products
- FOSSBilling FOSSBilling < 0.8.0
Timeline
- 2026-06-12: advisory: GitHub security advisory published
- 2026-07-06: disclosed: NVD publication date