FOSSBilling vulnerabilities
CVEs whose affected-version data names the FOSSBilling package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-111046Low· 2.3FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_…
CVE-2026-111053Medium· 6.9FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template_exists endpoint permits path traversal because templateExists uses Path::join on the attacker-con…
CVE-2026-111056Medium· 6.9FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signu…