Executive brief
FOSSBilling is an open-source platform used by businesses to manage client billing and automated services. A security flaw allows anyone with a valid API key to view internal configuration data that should be restricted to administrators. This could expose sensitive business information such as internal pricing discounts, feature limits, and account expiration details.
Technical details
An information disclosure vulnerability exists in the Guest 'serviceapikey/get_info' API endpoint due to missing authentication and authorization checks. The 'get_info()' method in 'src/modules/Serviceapikey/Api/Guest.php' retrieves the full database record for a provided API key, including all 'custom_*' configuration fields. While the endpoint is intended for guest use, it fails to restrict access to sensitive metadata such as rate limits, feature flags, and internal pricing tiers. An attacker with a valid API key can query this endpoint to extract administrative configuration parameters. The issue is resolved in version 0.8.0.
Affected products
- FOSSBilling FOSSBilling >= 0.5.3, <= 0.7.2
Timeline
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: NVD publication date