CVE-2026-42331: FOSSBilling missing authorization in guest Invoice API endpoints
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge of an invoice hash to modify the payment gateway associated with an unpaid invoice. An attacker who obtains an invoice hash, which may leak through shared URLs, referrer headers, or email links, can change the gatewayid on an unpaid invoice to any payment gateway configured in the system. This does not allow redirecting payments to an arbitrary external endpoint, as the gateway must already be installed and configured by an administrator. The practical impact is further limited by the invoiceaccessiblefromhash system setting. Version 0.8.0 contains a patch. No known workarounds are available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42331?
The severity of CVE-2026-42331 is rated as high with a score of 7.7.
How do I fix CVE-2026-42331?
To fix CVE-2026-42331, upgrade FOSSBilling to version 0.8.0 or later where the authorization checks have been implemented.
What type of vulnerability is CVE-2026-42331?
CVE-2026-42331 is classified as a missing authorization vulnerability affecting the Guest API invoice/update endpoint.
Who is affected by CVE-2026-42331?
Any FOSSBilling users prior to version 0.8.0 who expose the Guest API invoice/update endpoint are affected by CVE-2026-42331.
What can an attacker do with CVE-2026-42331?
An attacker can modify payment details if they possess knowledge of an invoice hash due to the missing authorization in the API.