CyberRota Analysis
AI-GeneratedFOSSBilling versions 0.5.3 through 0.7.2 have a vulnerability in the Guest `serviceapikey/get_info` API endpoint, which is accessible without authentication, allowing any user with a valid API key to access sensitive configuration parameters. This exposure can lead to unauthorized disclosure of business-critical information, including pricing and access controls. Organizations using affected versions should prioritize upgrading to version 0.8.0 or implementing recommended workarounds to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. Version 0.8.0 patches the issue. Some workarounds are available. Administrators can avoid storing sensitive data in `custom_*` API key configuration fields, monitor API logs for suspicious calls to `/api/guest/serviceapikey/get_info`, and/or disable the Serviceapikey module if not in active use.