Read the docs
TI-2026-76426 Aliases CVE-2026-111046

FOSSBilling flaw exposes deactivated extension configuration to staff

Priority LOW 12CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

FOSSBilling from 0.8.4 before 0.8.6 skips its permission checks for inactive non-core modules, so access is not enforced. A low-privileged staff account with module-level extension access can read decrypted stored extension secrets and overwrite the configuration of a deactivated module (CWE-862). This flaw remained after an earlier authorization fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with module-level extension access targets a deactivated non-core module through extension/config_get or extension/config_save. The account can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated non-core module to read decrypted retained extension secrets and overwrite stored extension configuration. The getConfig function returns the decrypted stored configuration despite the module's inactive state. This residual path remained after the earlier CVE-2026-62962 authorization fix. This issue is fixed in version 0.8.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed FOSSBilling (FOSSBilling): 0.8.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FOSSBillingFOSSBilling0.8.4 to before 0.8.60.8.6Patch availableCNA
  • FOSSBilling VendorFOSSBilling Affected 0.8.4 to before 0.8.6 Fixed in 0.8.6 Patch available CNA

Remediation

Update FOSSBilling to version 0.8.6, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA FOSSBilling (FOSSBilling) Fixed in 0.8.6

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111046

References

Other 4

  • TI-2023-03258 SQL Injection in fossbilling/fossbilling CVSS 3.1CRITICAL 9.8
  • TI-2023-03719 Insufficient Session Expiration in fossbilling/fossbilling CVSS 3.1CRITICAL 9.8
  • TI-2023-03259 Unrestricted Upload of File with Dangerous Type in fossbilling/fossbilling CVSS 3.1HIGH 8.8
  • TI-2023-03261 Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbilling CVSS 3.1HIGH 8.0
  • TI-2026-30636 FOSSBilling missing authorization in guest Invoice API endpoints CVSS 4.0HIGH 7.7
  • TI-2023-03173 Code Injection in fossbilling/fossbilling CVSS 3.1HIGH 7.2
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences