CVE Intelligence
Analysis AI-assisted

CVE-2026-33543: FOSSBilling authentication bypass in guest admin creation endpoint

FOSSBilling versions 0.7.2 and prior contain an authentication bypass in a guest API endpoint meant for initial administrator setup. The endpoint stays reachable after an administrator exists, which can allow creation of a privileged admin account. GitHub rates it Critical with CVSS 4.0 9.3 and reports a fix in version 0.8.0.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

FOSSBilling is an open-source billing and client management system. According to the GitHub advisory, versions 0.7.2 and prior expose a guest API endpoint intended for initial administrator bootstrap. That endpoint stays reachable after an administrator already exists because of a flawed admin-existence check.

Impact

  • The advisory describes an authentication bypass (CWE-288) that can lead to creation of a new administrator account and an immediate privileged session.
  • The CVSS 4.0 base score recorded by GitHub is 9.3 (Critical), with network attack vector, no privileges and no user interaction required, and high impact on confidentiality, integrity and availability.
  • Because the check is bypassed, the protection meant for first-time setup is not enforced once an administrator already exists.

Affected products and versions

  • Product: FOSSBilling.
  • Versions 0.7.2 and prior are described as affected in the record text.
  • Version 0.8.0 is described as containing the fix, and the release tag is cited in the references.
  • The structured affected and fixes fields in the record are empty, so version ranges rely on the description text.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is recorded there.
  • No confirmed exploitation appears in the sources consulted for this analysis. EPSS data is absent from the record.

Remediation and mitigation

  • Upgrade FOSSBilling to version 0.8.0 or later, as indicated by the advisory and release tag.
  • If an immediate upgrade is not possible, restrict access to guest API routes at the network or reverse proxy layer. The record does not describe an official workaround, so this is a general defensive measure and not a vendor-verified mitigation.
  • After upgrading, review the list of administrator accounts and remove any not created by your team. Rotate credentials for existing administrators and review active sessions.

Detection guidance

  • Review web server and application logs for requests to guest API paths related to staff creation, especially those made after initial setup was completed.
  • Monitor for newly created administrator accounts and for administrator logins from unexpected sources or times.
  • Correlate account creation events with access to the guest API.

Limitations of the available information

  • The record does not provide a detailed list of affected builds, a vendor-supplied workaround or a patch diff.
  • EPSS and SSVC data are absent.
  • The sources consulted are the GitHub advisory, the release tag, and the NVD and CVE.org record pages listed in the references.

Frequently asked questions

Which FOSSBilling versions are affected by CVE-2026-33543?

The record states that versions 0.7.2 and prior are affected. The fix is described as available in version 0.8.0.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still patch promptly given the critical rating.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.