CVE-2026-53643: FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the canalwaysaccess module flag (which grants all staff access to certain modules) and insufficient permission checks or unsafe parameter handling on individual endpoints. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive settings and/or use a reverse proxy or WAF to restrict access to the affected endpoints to trusted IP addresses or higher-privilege roles.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Compensating control
Restrict access to the affected admin API endpoints by using a reverse proxy or WAF to allow requests only from trusted IP addresses or from higher-privilege roles.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53643?
CVE-2026-53643 has a risk rating of 65.
What actions can low-privileged staff accounts perform due to CVE-2026-53643?
Low-privileged staff accounts can perform unauthorized actions via admin API endpoints.
Which versions of FOSSBilling are affected by CVE-2026-53643?
FOSSBilling versions prior to 0.8.0 are affected by CVE-2026-53643.
What is the root cause of CVE-2026-53643?
The root cause of CVE-2026-53643 is a combination of the 'can_always_access' module flag and improper access controls.
How do I mitigate the risk of CVE-2026-53643?
To mitigate the risk of CVE-2026-53643, upgrade to FOSSBilling version 0.8.0 or later.