CyberRota Analysis
AI-GeneratedFOSSBilling versions prior to 0.8.0 are vulnerable to an unauthenticated mass assignment flaw in the client self-registration endpoint, allowing attackers to assign themselves to arbitrary client groups. This vulnerability can be exploited to gain unauthorized access to group-restricted discounts, potentially leading to financial losses for businesses. Organizations using FOSSBilling should prioritize upgrading to version 0.8.0 or implementing workarounds to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).