CVE-2026-53647: FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest serviceapikey/getinfo API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (custom fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. Version 0.8.0 patches the issue. Some workarounds are available. Administrators can avoid storing sensitive data in custom API key configuration fields, monitor API logs for suspicious calls to /api/guest/serviceapikey/getinfo, and/or disable the Serviceapikey module if not in active use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FOSSBillingto a version that resolves this vulnerability.Fixed in 0.8.0 - Configuration
If the Serviceapikey module is not actively used, disable it to prevent access to the guest serviceapikey get_info endpoint.
FOSSBilling Serviceapikey module disable_if_not_in_active_use = true - Configuration
Do not store sensitive or business-sensitive data in custom_* API key configuration fields (e.g., pricing tiers, feature flags, rate limits, expiry overrides, access scope data).
FOSSBilling API key configuration (custom_* fields) avoid_storing_sensitive_data_in_custom_fields = true - Compensating control
Monitor API logs for suspicious calls to /api/guest/serviceapikey/get_info and investigate any unexpected access attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53647?
CVE-2026-53647 has a risk rating of 48, indicating a significant security vulnerability.
How do I fix CVE-2026-53647?
To fix CVE-2026-53647, update FOSSBilling to version 0.7.3 or later, which addresses the unauthenticated API key configuration disclosure.
What specific issue does CVE-2026-53647 cause?
CVE-2026-53647 allows unauthenticated access to sensitive configuration parameters via the guest API endpoint.
Which versions of FOSSBilling are affected by CVE-2026-53647?
CVE-2026-53647 affects FOSSBilling versions 0.5.3 through 0.7.2.
Who can exploit CVE-2026-53647?
Any user with a valid API key can exploit CVE-2026-53647 to retrieve custom configuration parameters without authentication.