CVE-2026-43925: FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Configuration
Disable client self-registration (enable Settings → Clients → Disable signup) to prevent unauthenticated mass assignment during guest client registration.
FOSSBilling (Admin UI) Settings → Clients → Disable signup = true - Configuration
Remove group restrictions from promo codes to prevent group-gated eligibility from enabling unauthorized discount code use.
FOSSBilling promo codes Group restrictions on promo codes = removed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43925?
CVE-2026-43925 has a risk score of 29, indicating a moderate security concern.
How do I fix CVE-2026-43925?
To fix CVE-2026-43925, upgrade to FOSSBilling version 0.8.0 or later.
What impact does CVE-2026-43925 have on FOSSBilling?
CVE-2026-43925 allows unauthorized users to assign themselves to arbitrary client groups, potentially misusing promo codes.
Who is affected by CVE-2026-43925?
Any user of FOSSBilling prior to version 0.8.0 is vulnerable to CVE-2026-43925.
What specific vulnerability is identified in CVE-2026-43925?
CVE-2026-43925 is a mass assignment vulnerability in the client self-registration endpoint.