CVE Intelligence
Analysis AI-assisted

CVE-2026-27604: FOSSBilling Authorization Bypass Exposing Privileged API System Endpoints

FOSSBilling versions from 0.5.4 up to but not including 0.8.0 contain an authorization bypass in API role handling that lets unauthenticated requests reach privileged /api/system/ endpoints. The GitHub CNA assigns a CVSS 4.0 base score of 10, and the record states that version 0.8.0 patches the issue. No confirmed exploitation appears in the sources consulted, and the record shows the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

FOSSBilling is a free, open-source billing and client management system. CVE-2026-27604 describes an authorization bypass in its API role handling. According to the record, the flaw affects releases from 0.5.4 up to but not including 0.8.0 and is fixed in 0.8.0. The main source consulted is the NVD entry.

Impact

  • Unauthenticated requests can reach privileged /api/system/* endpoints.
  • The record states these endpoints resolve to the cron admin identity, so administrative API methods can be invoked without credentials, a session or a CSRF token.
  • The GitHub CNA assigns a CVSS 4.0 base score of 10 with high confidentiality, integrity and availability impact.
  • The weakness mapped in the record is CWE-200, Exposure of Sensitive Information.

The record does not detail which data or actions are reachable through each endpoint.

Affected products and versions

  • FOSSBilling starting at version 0.5.4 and prior to version 0.8.0.
  • The structured affected and fixes fields in the record are empty, so the version range comes from the description text.
  • Version 0.8.0 is stated to patch the issue.

Exploitation status

The record shows that this CVE is not listed in CISA KEV. No confirmed exploitation or active exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Upgrade FOSSBilling to version 0.8.0 or later.
  • Until upgrading is possible, block external access to /api/system/* at the reverse proxy or web application firewall.
  • Restrict API access to trusted source IP addresses using the api.allowed_ips setting.
  • Rotate all administrator and client API tokens, invalidate active sessions and reset high-privilege credentials.
  • If suspicious access is found, treat the system as potentially compromised and follow your incident response process.

Detection guidance

  • Review web server, reverse proxy and API logs for requests to /api/system/ from unexpected sources or without the expected authentication.
  • Look for administrative actions in the billing system that cannot be tied to a known operator.
  • Correlate any findings with recent token and session changes.

Limitations of the available information

  • The record does not include vendor-provided affected or fixed product entries in its structured fields.
  • The record does not address versions before 0.5.4; whether they are affected is unknown.
  • The exact exploitation path, the network position required and the exposure of real deployments are not described in the record.
  • The GitHub advisories listed in the record were not retrieved, so their details are not reflected here.

Frequently asked questions

Which FOSSBilling versions are affected?

According to the record, versions from 0.5.4 up to but not including 0.8.0 are affected. The record does not address versions before 0.5.4.

What is the fix?

The description states that version 0.8.0 patches the issue. Upgrading to that version or later is the primary remediation.

Is this vulnerability being exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.