CyberRota Analysis
AI-GeneratedFOSSBilling versions prior to 0.8.0 allow suspended or inactive client and staff/admin accounts to maintain active sessions, as the system does not invalidate these sessions upon account status changes. This vulnerability can lead to unauthorized access, enabling users with deactivated accounts to exploit their existing sessions until they expire. Organizations using FOSSBilling should prioritize upgrading to version 0.8.0 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing authenticated sessions are not invalidated. The session identity loaders in src/di.php (loggedin_client and loggedin_admin) only reject sessions if the backing account record no longer exists in the database. They do not verify that the account's status is still active. This allows a suspended or deactivated user to retain full access until their session naturally expires. This issue has been fixed in version 0.8.0.