CyberRota Analysis
AI-GeneratedFOSSBilling versions prior to 0.8.0 are vulnerable to a privilege escalation issue that allows low-privileged staff accounts to grant themselves arbitrary permissions via the admin API, effectively bypassing role-based access controls. This could lead to unauthorized access and manipulation of sensitive billing and client management functions. Organizations using FOSSBilling should prioritize upgrading to version 0.8.0 or implementing recommended workarounds to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has `staff.create_and_edit_staff` can call `/api/admin/staff/permissions_update` targeting their own account and write any permission structure, bypassing the intended role-based access control boundary. Version 0.8.0 patches the issue. Some workarounds are available. Restrict the `staff.create_and_edit_staff` permission to only highly trusted staff members and/or use a reverse proxy or WAF to restrict access to `/api/admin/staff/permissions_update` to specific trusted roles.