# FOSSBilling vulnerabilities Source: https://junglewise.ai/threats/technologies/fossbilling Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/fossbilling.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 32 vulnerabilities in FOSSBilling: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-111048, was published on 2 November 2026. 5 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 5 - Last 90 days: 5 - All time: 32 (0 critical, 0 exploited in the wild) ## About FOSSBilling FOSSBilling is an open-source billing and client management solution designed for service providers. ## Latest FOSSBilling vulnerabilities - [CVE-2026-111048: FOSSBilling stored XSS in support ticket notes](https://junglewise.ai/threats/cve-2026-111048-fossbilling-is-an-open-source-billing-and-client-management) (info, published 2 Nov 2026) - [CVE-2026-112374: FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-111056: FOSSBilling email enumeration via guest signup endpoint](https://junglewise.ai/threats/cve-2026-111056-fossbilling-is-an-open-source-billing-and-client-management) (info, published 19 Oct 2026) - [CVE-2026-111053: FOSSBilling path traversal in template_exists endpoint](https://junglewise.ai/threats/cve-2026-111053-fossbilling-is-an-open-source-billing-and-client-management) (info, published 19 Oct 2026) - [CVE-2026-111046: FOSSBilling authorization bypass in extension configuration management](https://junglewise.ai/threats/cve-2026-111046-fossbilling-is-an-open-source-billing-and-client-management) (info, published 19 Oct 2026) - [CVE-2026-53648: FOSSBilling file overwrite via filename collision in downloadable products](https://junglewise.ai/threats/cve-2026-53648-fossbilling-file-overwrite-via-filename-collision-in-downloadable) (info, CVSS 5.1, published 7 Jul 2026) - [CVE-2026-53647: FOSSBilling information disclosure in Guest serviceapikey/get_info API](https://junglewise.ai/threats/cve-2026-53647-fossbilling-information-disclosure-in-guest-serviceapikey-get) (info, CVSS 6.9, published 7 Jul 2026) - [CVE-2026-53646: FOSSBilling weak password recovery mechanism in Client API](https://junglewise.ai/threats/cve-2026-53646-fossbilling-weak-password-recovery-mechanism-in-client-api) (info, CVSS 7.7, published 6 Jul 2026) - [CVE-2026-53645: FOSSBilling privilege escalation in staff permission management](https://junglewise.ai/threats/cve-2026-53645-fossbilling-privilege-escalation-in-staff-permission-management) (info, CVSS 8.5, published 6 Jul 2026) - [CVE-2026-53644: FOSSBilling authorization bypass in Serviceapikey module](https://junglewise.ai/threats/cve-2026-53644-fossbilling-authorization-bypass-in-serviceapikey-module) (info, CVSS 8.6, published 6 Jul 2026) - [CVE-2026-53643: FOSSBilling authorization bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-53643-fossbilling-authorization-bypass-in-admin-api-endpoints) (info, CVSS 8.7, published 6 Jul 2026) - [CVE-2026-53642: FOSSBilling incorrect authorization in client area access control](https://junglewise.ai/threats/cve-2026-53642-fossbilling-incorrect-authorization-in-client-area-access-control) (info, CVSS 5.3, published 6 Jul 2026) - [CVE-2026-53641: FOSSBilling stored XSS in client email history views](https://junglewise.ai/threats/cve-2026-53641-fossbilling-stored-xss-in-client-email-history-views) (info, CVSS 4.8, published 6 Jul 2026) - [CVE-2026-53640: FOSSBilling missing authorization in admin API read endpoints](https://junglewise.ai/threats/cve-2026-53640-fossbilling-missing-authorization-in-admin-api-read-endpoints) (info, CVSS 2.3, published 6 Jul 2026) - [CVE-2026-43928: FOSSBilling invoice underpayment in PayPalEmail adapter](https://junglewise.ai/threats/cve-2026-43928-fossbilling-invoice-underpayment-in-paypalemail-adapter) (info, CVSS 2.3, published 6 Jul 2026) - [CVE-2026-43927: FOSSBilling race condition in cart checkout promo code validation](https://junglewise.ai/threats/cve-2026-43927-fossbilling-race-condition-in-cart-checkout-promo-code-validation) (info, CVSS 6.9, published 6 Jul 2026) - [CVE-2026-43925: FOSSBilling mass assignment in client self-registration](https://junglewise.ai/threats/cve-2026-43925-fossbilling-mass-assignment-in-client-self-registration) (info, CVSS 6.9, published 6 Jul 2026) - [CVE-2026-43921: FOSSBilling PHP code injection in Config component](https://junglewise.ai/threats/cve-2026-43921-fossbilling-php-code-injection-in-config-component) (info, CVSS 8.9, published 6 Jul 2026) - [CVE-2026-43918: FOSSBilling insufficient session expiration for suspended accounts](https://junglewise.ai/threats/cve-2026-43918-fossbilling-insufficient-session-expiration-for-suspended) (info, CVSS 8.7, published 6 Jul 2026) - [CVE-2026-42341: FOSSBilling unauthenticated payment bypass in IPN callback](https://junglewise.ai/threats/cve-2026-42341-fossbilling-unauthenticated-payment-bypass-in-ipn-callback) (info, CVSS 9.2, published 6 Jul 2026) - [CVE-2026-42331: FOSSBilling missing authorization in Guest API invoice endpoints](https://junglewise.ai/threats/cve-2026-42331-fossbilling-missing-authorization-in-guest-api-invoice-endpoints) (info, CVSS 7.7, published 6 Jul 2026) - [CVE-2026-33734: FOSSBilling SQL injection in Massmailer module](https://junglewise.ai/threats/cve-2026-33734-fossbilling-sql-injection-in-massmailer-module) (info, CVSS 6.9, published 6 Jul 2026) - [CVE-2026-43920: FOSSBilling missing authentication in /run-patcher endpoint](https://junglewise.ai/threats/cve-2026-43920-fossbilling-missing-authentication-in-run-patcher-endpoint) (info, CVSS 6.9, published 26 Jun 2026) - [CVE-2026-33543: FOSSBilling authentication bypass in guest staff creation API](https://junglewise.ai/threats/cve-2026-33543-fossbilling-authentication-bypass-in-guest-staff-creation-api) (info, CVSS 9.3, published 24 Jun 2026) - [CVE-2026-27708: FOSSBilling IDOR in Servicecustom Client API](https://junglewise.ai/threats/cve-2026-27708-fossbilling-idor-in-servicecustom-client-api) (info, CVSS 7.1, published 24 Jun 2026) ## Most severe FOSSBilling vulnerabilities - [CVE-2026-112374: FOSSBilling CSRF vulnerability in staff guest login endpoint](https://junglewise.ai/threats/cve-2026-112374-fossbilling-before-0-8-9-contains-a-cross-site-request-forgery) (medium, CVSS 4.3, published 30 Oct 2026) - [CVE-2026-27604: FOSSBilling authorization bypass in system API endpoints](https://junglewise.ai/threats/cve-2026-27604-fossbilling-authorization-bypass-in-system-api-endpoints) (info, CVSS 10, published 23 Jun 2026) - [CVE-2026-28496: FOSSBilling Server-Side Template Injection in Twig rendering](https://junglewise.ai/threats/cve-2026-28496-fossbilling-server-side-template-injection-in-twig-rendering) (info, CVSS 9.4, published 23 Jun 2026) - [CVE-2026-33543: FOSSBilling authentication bypass in guest staff creation API](https://junglewise.ai/threats/cve-2026-33543-fossbilling-authentication-bypass-in-guest-staff-creation-api) (info, CVSS 9.3, published 24 Jun 2026) - [CVE-2026-42341: FOSSBilling unauthenticated payment bypass in IPN callback](https://junglewise.ai/threats/cve-2026-42341-fossbilling-unauthenticated-payment-bypass-in-ipn-callback) (info, CVSS 9.2, published 6 Jul 2026) - [CVE-2026-43921: FOSSBilling PHP code injection in Config component](https://junglewise.ai/threats/cve-2026-43921-fossbilling-php-code-injection-in-config-component) (info, CVSS 8.9, published 6 Jul 2026) - [CVE-2026-53643: FOSSBilling authorization bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-53643-fossbilling-authorization-bypass-in-admin-api-endpoints) (info, CVSS 8.7, published 6 Jul 2026) - [CVE-2026-43918: FOSSBilling insufficient session expiration for suspended accounts](https://junglewise.ai/threats/cve-2026-43918-fossbilling-insufficient-session-expiration-for-suspended) (info, CVSS 8.7, published 6 Jul 2026) - [CVE-2026-53644: FOSSBilling authorization bypass in Serviceapikey module](https://junglewise.ai/threats/cve-2026-53644-fossbilling-authorization-bypass-in-serviceapikey-module) (info, CVSS 8.6, published 6 Jul 2026) - [CVE-2026-53645: FOSSBilling privilege escalation in staff permission management](https://junglewise.ai/threats/cve-2026-53645-fossbilling-privilege-escalation-in-staff-permission-management) (info, CVSS 8.5, published 6 Jul 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "FOSSBilling vulnerabilities", https://junglewise.ai/threats/technologies/fossbilling, 10 November 2026.