CVE-2026-53640
FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data
CVSS Score
0.0
EPSS Score
0.2%
EPSS Percentile
13th
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admin API endpoints that lack permission checks. While sibling write endpoints correctly enforce fine-grained permissions, the corresponding read endpoints have no authorization guards. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive data and/or use a reverse proxy or WAF to restrict access to the affected endpoints.
| CWE | CWE-200 CWE-862 |
| Vendor | fossbilling |
| Product | fossbilling |
| Published | Jul 6, 2026 |
| Last Updated | Jul 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for fossbilling fossbilling
Be the first to know when new unknown vulnerabilities affecting fossbilling fossbilling are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
FOSSBilling / FOSSBilling
< 0.8.0