FOSSBilling has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.9 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.9
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-111056Medium· 6.9FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint38CVE-2026-111053Medium· 6.9FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists38CVE-2026-111046Low· 2.3FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions13
FOSSBilling vulnerabilities
CVEs affecting FOSSBilling, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-111046Low· 2.3FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_…
CVE-2026-111053Medium· 6.9FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template_exists endpoint permits path traversal because templateExists uses Path::join on the attacker-con…
CVE-2026-111056Medium· 6.9FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signu…