---
id: CVE-2026-111046
title: >-
  FOSSBilling: Low-privileged staff can read and modify configuration of
  deactivated extensions
summary: >-
  FOSSBilling is an open source billing and client-management platform. From
  0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core
  modules because its early return on !isExtensionActive skips the module-access
  and manage_…
severity: low
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-862
  - CWE-863
vendor: FOSSBilling
product: FOSSBilling
affected:
  - 'FOSSBilling >= 0.8.4, < 0.8.6'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T15:59:39.233353Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T16:33:30.338Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111046'
references:
  - url: >-
      https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-3g7m-ph2r-jhcx
    label: >-
      https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-3g7m-ph2r-jhcx
  - url: 'https://github.com/FOSSBilling/FOSSBilling/pull/4184'
    label: 'https://github.com/FOSSBilling/FOSSBilling/pull/4184'
  - url: >-
      https://github.com/FOSSBilling/FOSSBilling/commit/7a7a30984b58cd1008a573fc70296a7653d8ae04
    label: >-
      https://github.com/FOSSBilling/FOSSBilling/commit/7a7a30984b58cd1008a573fc70296a7653d8ae04
  - url: 'https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.6'
    label: 'https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.6'
tags:
  - cve.org
ingestedAt: '2026-10-19T16:32:30.074Z'
---

## Overview

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with module-level extension access targets a deactivated non-core module through extension/config_get or extension/config_save. The account can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated non-core module to read decrypted retained extension secrets and overwrite stored extension configuration. The getConfig function returns the decrypted stored configuration despite the module's inactive state. This residual path remained after the earlier CVE-2026-62962 authorization fix. This issue is fixed in version 0.8.6.

## Affected

- `FOSSBilling >= 0.8.4, < 0.8.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.