CVE-2026-53644: FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders
FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an active state (e.g., suspended, canceled). The root cause is missing order-state validation in two client API endpoints, despite an isActive() helper already existing in the Serviceapikey module and the frontend UI correctly gating access on order.status == 'active'. Version 0.8.0 contains a fix. Some workarounds are available. If the Serviceapikey module is not needed, uninstall it to remove the affected endpoints. One may also use a reverse proxy or WAF to restrict access to /api/client/order/service and /api/client/serviceapikey/reset based on application-level order-state logic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Remove
Remove
FOSSBilling (Serviceapikey module)from your environment.If the `Serviceapikey` module is not needed, uninstall it to remove the affected endpoints (`/api/client/serviceapikey/reset` and related service API functionality).
- Compensating control
Use a reverse proxy or WAF to restrict access to `/api/client/order/service` and `/api/client/serviceapikey/reset` based on application-level order-state logic (only allow when the order is active, matching the frontend gating `order.status == 'active'`).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53644?
CVE-2026-53644 has a risk rating of 52, indicating a moderate severity level.
How do I fix CVE-2026-53644?
To fix CVE-2026-53644, update FOSSBilling to version 0.7.3 or later, where the issue with order-state validation is addressed.
What types of orders are affected by CVE-2026-53644?
CVE-2026-53644 affects non-active orders, including those that are suspended or canceled.
Who is vulnerable to CVE-2026-53644?
Authenticated clients using FOSSBilling versions 0.5.3 through 0.7.2 are vulnerable to CVE-2026-53644.
What consequences can occur due to CVE-2026-53644?
Due to CVE-2026-53644, clients may exploit the vulnerability to read and reset API key secrets for non-active orders, compromising security.