CVE-2026-23513: FOSSBilling: Broken Authorization in Client Transaction and Order Listings
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In ServiceTransaction::getSearchQuery() and Order\Service::getSearchQuery(), OR-based search/action filters were appended without grouping, allowing SQL operator precedence to evaluate OR clauses independently of the enforced clientid constraint. Crafted requests could therefore return records and metadata belonging to other clients, including identifiers, amounts, status, timestamps, and related fields. This issue was fixed in version 0.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23513?
The severity of CVE-2026-23513 is classified as high with a CVSS score of 7.1.
How do I fix CVE-2026-23513?
To fix CVE-2026-23513, upgrade to FOSSBilling version 0.8.0 or later, which addresses the broken authorization issue.
What is the impact of CVE-2026-23513 on FOSSBilling?
CVE-2026-23513 allows authenticated clients to bypass tenant scoping and access other clients' data.
Which versions of FOSSBilling are affected by CVE-2026-23513?
FOSSBilling versions 0.7.2 and prior are affected by CVE-2026-23513.
When was CVE-2026-23513 published?
CVE-2026-23513 was published on June 23, 2026.