Is CVE-2026-53643 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53643 being exploited in the wild.

How severe is CVE-2026-53643?

Informational severity, with a CVSS score of 8.7, published 6 July 2026.

Is there a fix for CVE-2026-53643?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53643 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53643?

Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53643: FOSSBilling authorization bypass in admin API endpoints

CVE-2026-53643 · Severity: info · CVSS 8.7 · Published 2026-07-06

FOSSBilling is an open-source platform used by businesses to manage client billing, support tickets, and service provisioning. A security flaw allows staff members with low-level access (such as basic support agents) to view sensitive company data, including bank details and API keys for payment gateways. Additionally, these users can disrupt operations by forcing other administrators to log out or triggering automated billing processes prematurely.

Technologies: FOSSBilling. Vendors: FOSSBilling.

Quick answers

Is CVE-2026-53643 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53643 being exploited in the wild.
How severe is CVE-2026-53643?: Informational severity, with a CVSS score of 8.7, published 6 July 2026.
Which products and versions are affected?: FOSSBilling < 0.8.0.
Is there a fix for CVE-2026-53643?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53643 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53643?: Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple authorization flaws exist in FOSSBilling's admin API due to the 'can_always_access' module flag in 'src/modules/Staff/Service.php', which bypasses module-level permission checks for all authenticated staff. Combined with missing endpoint-level validation, low-privileged attackers can exploit various endpoints: '/api/admin/system/get_params' and '/api/admin/extension/config_get' leak system settings and decrypted extension secrets (SMTP/API keys); '/api/admin/profile/destroy_sessions' allows arbitrary session termination; and '/api/admin/system/messages' can be used to trigger system cron jobs. Furthermore, incomplete field protection in 'system/update_params' allows unauthorized modification of bank-related configuration fields. These issues are resolved in version 0.8.0.

Affected products

FOSSBilling FOSSBilling < 0.8.0

Timeline

2026-06-12: advisory: GitHub security advisory published
2026-07-06: disclosed: NVD publication date

References

https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-563q-g4r4-6f9m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.