CVE-2026-111056: FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote party that can reach the FOSSBilling guest API can submit email addresses to the guest client-creation endpoint and compare the responses.
Which deployments are affected?
FOSSBilling versions from 0.1.0 through versions before 0.8.7 are affected. The issue is fixed in version 0.8.7.
What information can an attacker obtain?
An attacker can determine whether a target email address is already associated with a registered FOSSBilling client. The issue exposes account existence, not the client account contents described in the available data.
How can I check whether my instance is vulnerable?
Check the deployed FOSSBilling version and whether unauthenticated users can access POST /api/guest/client/create. On affected versions, submitting an already registered email produces a distinct unredacted error compared with a non-registered email.