CVE-2026-111046: FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with module-level extension access targets a deactivated non-core module through extension/configget or extension/configsave. The account can call api/admin/extension/configget or api/admin/extension/configsave for a deactivated non-core module to read decrypted retained extension secrets and overwrite stored extension configuration. The getConfig function returns the decrypted stored configuration despite the module's inactive state. This residual path remained after the earlier CVE-2026-62962 authorization fix. This issue is fixed in version 0.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.6
Event History
Frequently Asked Questions
Which deployments are exposed?
FOSSBilling versions from 0.8.4 until 0.8.6 are affected when they retain configuration for a deactivated non-core module and low-privileged staff accounts have module-level access to that extension.
What access does an attacker need?
An attacker needs a low-privileged staff account with module-level extension access. They can then target a deactivated non-core module through the administrative extension configuration endpoints.
What information or changes are possible?
The attacker can use api/admin/extension/config_get to retrieve decrypted retained extension secrets and configuration. They can use api/admin/extension/config_save to overwrite the stored configuration for the deactivated non-core module.
What should be done if an immediate upgrade is not possible?
Restrict low-privileged staff access to affected extensions and remove or rotate secrets retained in configuration for deactivated non-core modules. Review stored configuration for those modules for unauthorized changes.
How can administrators check for exploitation?
Review use of api/admin/extension/config_get and api/admin/extension/config_save involving deactivated non-core modules, especially by low-privileged staff accounts. Check the affected modules' stored configuration for unexpected modifications and rotate any retained secrets that may have been disclosed.