CVE-2026-116257: BillaBear Installation InstallController.php processInstall missing authentication
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
BillaBear versions up to and including 2025.01.03 are affected. The issue is in the Installation Handler's processInstall function in src/BillaBear/Controller/InstallController.php.
Can this be exploited remotely without credentials?
Yes. The vulnerability is remotely exploitable and is rated as requiring no privileges or user interaction. It is caused by missing authentication in the installation processing function.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
Is a vendor fix or response documented?
No vendor response is documented in the available information. The vendor was contacted before disclosure but did not respond.