Executive brief
FOSSBilling is an open-source platform used by businesses to manage client billing, orders, and support. A security flaw allows staff members with limited access to upgrade their own account permissions to full administrator status. This could allow a malicious employee to access sensitive customer data, modify financial records, or take complete control of the billing system.
Technical details
An authorization bypass exists in the FOSSBilling admin API due to missing self-edit prevention and privilege-ceiling enforcement. Specifically, the `permissions_update` endpoint in `src/modules/Staff/Api/Admin.php` allows any staff user with the `staff.create_and_edit_staff` permission to call the `/api/admin/staff/permissions_update` endpoint. Because the underlying `setPermissions()` service method does not verify if the target ID matches the caller's ID or restrict the scope of permissions being granted, a low-privileged user can submit a JSON structure granting themselves access to all system modules. This results in persistent privilege escalation stored in the database. The issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling < 0.8.0
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: NVD publication date
- 2026-08-01: patched: Version 0.8.0 released to address the issue