/Vulnerability Library

FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass

CVE-2026-27604
Verified

Description

FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.

Severity

Critical

Exploit Probability

1%

Affected Product

fossbilling

Published Date

September 19, 2026

Template Author

str4k3r

CVE-2026-27604.yaml
9.5Severity

CVSS Metrics

CVE ID:
cve-2026-27604
CWE ID:
cwe-862

References

https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-78x5-c8gw-8279https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0https://nvd.nist.gov/vuln/detail/CVE-2026-27604

Remediation Steps

Upgrade FOSSBilling to 0.8.0 or later, or block external access to /api/system/*.