CyberRota Analysis
AI-GeneratedFOSSBilling versions prior to 0.8.0 are vulnerable due to low-privileged staff accounts being able to exploit admin API endpoints, resulting from inadequate permission checks and unsafe parameter handling. This flaw can lead to unauthorized actions that compromise the integrity of the billing and client management system. Organizations using FOSSBilling should prioritize upgrading to version 0.8.0 or implementing workarounds to restrict access to sensitive endpoints, particularly those with low-privileged staff accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_always_access` module flag (which grants all staff access to certain modules) and insufficient permission checks or unsafe parameter handling on individual endpoints. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive settings and/or use a reverse proxy or WAF to restrict access to the affected endpoints to trusted IP addresses or higher-privilege roles.