# CVE-2026-53640: FOSSBilling missing authorization in admin API read endpoints

Source: https://junglewise.ai/threats/cve-2026-53640-fossbilling-missing-authorization-in-admin-api-read-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-53640 · Severity: info · CVSS 2.3 · Published 2026-07-06

FOSSBilling is an open-source platform used by businesses to manage client billing and support services. A security flaw allows staff members with low-level access to view sensitive information they should not be able to see, such as client financial histories, administrator login logs, and internal system redirect rules. While these users cannot change the data, the exposed information could be used to plan further attacks or compromise privacy.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-53640 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53640 being exploited in the wild.

**How severe is CVE-2026-53640?** Informational severity, with a CVSS score of 2.3, published 6 July 2026.

**Which products and versions are affected?** FOSSBilling < 0.8.0.

**Is there a fix for CVE-2026-53640?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53640 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-53640?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

FOSSBilling prior to version 0.8.0 suffers from missing authorization checks (CWE-862) in several read-only admin API endpoints. While the system implements a two-layer permission model, affected endpoints in the Staff, Client, and Redirect modules fail to call the second-layer checkPermissionsAndThrowException() function. An authenticated attacker with low-privileged staff credentials can exploit this over the network to retrieve administrator login history (including IP addresses), staff permission matrices, client balance transaction records, and system redirect rules. The vulnerability is resolved in version 0.8.0 by implementing the missing action-level authorization guards.

## Affected products

- FOSSBilling FOSSBilling < 0.8.0

## Timeline

- 2026-06-12: advisory: GitHub security advisory published
- 2026-07-06: disclosed: NVD publication date

## References

- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jqw4-3hj3-8m4f](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-jqw4-3hj3-8m4f)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)