# CVE-2026-53645: FOSSBilling privilege escalation in staff permission management

Source: https://junglewise.ai/threats/cve-2026-53645-fossbilling-privilege-escalation-in-staff-permission-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-53645 · Severity: info · CVSS 8.5 · Published 2026-07-06

FOSSBilling is an open-source platform used by businesses to manage client billing, orders, and support. A security flaw allows staff members with limited access to upgrade their own account permissions to full administrator status. This could allow a malicious employee to access sensitive customer data, modify financial records, or take complete control of the billing system.

Technologies: [FOSSBilling](https://junglewise.ai/threats/technologies/fossbilling). Vendors: [FOSSBilling](https://junglewise.ai/threats/vendors/fossbilling).

## Quick answers

**Is CVE-2026-53645 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53645 being exploited in the wild.

**How severe is CVE-2026-53645?** Informational severity, with a CVSS score of 8.5, published 6 July 2026.

**Which products and versions are affected?** FOSSBilling < 0.8.0.

**Is there a fix for CVE-2026-53645?** A patch was published on 2026-08-01: Version 0.8.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53645 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-53645?** Check whether you run FOSSBilling at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in the FOSSBilling admin API due to missing self-edit prevention and privilege-ceiling enforcement. Specifically, the `permissions_update` endpoint in `src/modules/Staff/Api/Admin.php` allows any staff user with the `staff.create_and_edit_staff` permission to call the `/api/admin/staff/permissions_update` endpoint. Because the underlying `setPermissions()` service method does not verify if the target ID matches the caller's ID or restrict the scope of permissions being granted, a low-privileged user can submit a JSON structure granting themselves access to all system modules. This results in persistent privilege escalation stored in the database. The issue is resolved in version 0.8.0.

## Affected products

- FOSSBilling FOSSBilling < 0.8.0

## Timeline

- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: NVD publication date
- 2026-08-01: patched: Version 0.8.0 released to address the issue

## References

- [https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-4hf7-xxxw-64rm](https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-4hf7-xxxw-64rm)

## Related threats

- [FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery)
- [FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management)
- [FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management)