CyberRota Analysis
AI-GeneratedFOSSBilling versions 0.5.6 through 0.7.2 are vulnerable due to improper access controls that allow logged-in clients with unverified email addresses to access sensitive client-area pages, exposing real account data such as wallet balances and transaction history. This vulnerability poses a significant risk to user privacy and data security, particularly for organizations using these versions for client management. Users of affected versions should prioritize upgrading to version 0.8.0 to mitigate this risk, as no effective workarounds exist without modifying the source code.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enabled, a logged-in client with an unverified email address (`email_approved = 0`) can access all client-area pages (e.g. `/client/balance`, `/client/order/list`, `/client/invoice`) and read real account data, including wallet balances and transaction history. The API-side enforcement correctly restricts unverified clients to only profile-related endpoints, but the page-side enforcement is overly permissive, allowing any request whose path starts with `/client`. Version 0.8.0 contains a fix. No known workarounds that don't involve modifying the source code are available.