Loading story…
FOSSBilling disclosed two critical vulnerabilities that can be chained to give unauthenticated attackers administrative access and remote code execution on billing platforms used by hosting providers. CVE-2026-27604 is an authorization bypass in versions 0.5.4 through 0.7.2 that lets remote attackers reach privileged /api/system/* endpoints because the system API role is incorrectly mapped to the cron admin identity. CVE-2026-28496 is a Twig server-side template injection flaw affecting versions 0.1.0 through 0.7.2, where templates are rendered without a sandbox, exposing the Twig environment, API context, and the dependency injection container.
Researchers said the chain allows attackers to read and modify databases, enumerate administrators, create admin accounts, generate privileged API tokens, poison the Symfony cache used by the extension installer, and install a malicious module to execute code as the web server user. The exposure is significant because affected instances may hold customer PII, billing records, payment processor secrets, hosting control panel credentials, sessions, and API tokens. FOSSBilling patched both issues in version 0.8.0 and advised defenders to block external access to /api/system/*, restrict API access to trusted IPs, rotate admin and client API tokens, invalidate active sessions, reset high-privilege credentials, audit templates for malicious Twig expressions, and review logs for suspicious /api/system/ activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
CVE feed entries were published for the FOSSBilling authorization bypass and Twig SSTI vulnerabilities, assigning severity and summarizing affected versions, exploitation conditions, and mitigations.
VulnCheck publicly disclosed an unauthenticated remote code execution chain in FOSSBilling that combines CVE-2026-27604 with CVE-2026-28496 to reach admin functions, poison cache, install a malicious module, and execute code.
FOSSBilling published GitHub security advisories GHSA-78x5-c8gw-8279 for the auth bypass and GHSA-57mv-jm88-66jc for the Twig SSTI/RCE issue, documenting impact, affected versions, and mitigations.
FOSSBilling version 0.8.0 fixed CVE-2026-27604 and CVE-2026-28496. VulnCheck explicitly states this release occurred on 2026-05-28.
According to VulnCheck, FOSSBilling patched the reported issues upstream across April and May 2026 before public disclosure.
VulnCheck's timeline says the vulnerabilities were reported in April 2026, beginning coordinated disclosure for the auth bypass and Twig SSTI issues.
VulnCheck's disclosure timeline states the authorization bypass flaw later tracked as CVE-2026-27604 was introduced in July 2023.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in **Dolibarr ERP/CRM** allow authenticated administrators to achieve remote code execution through separate application paths. `CVE-2026-22666` affects versions before **23.0.2** and stems from the `dol_eval_standard()` function, which can be abused through computed extrafields and other evaluation paths because forbidden string checks are not properly enforced in whitelist mode and PHP dynamic callable syntax is not detected. The flaw enables arbitrary command execution via `eval()` and is classified as **CWE-95**. A second issue, `CVE-2026-23500`, affects versions before **23.0.0** and exposes an OS command injection bug in the ODT-to-PDF conversion workflow in `odf.php`. The `MAIN_ODT_AS_PDF` configuration constant is concatenated into a shell command passed to `exec()` without sanitization, allowing an authenticated administrator to inject shell separators and run arbitrary commands as the web server user when generating an ODT template. The vulnerabilities were addressed in **Dolibarr 23.0.0** and **23.0.2**, underscoring the need for organizations running Dolibarr to upgrade promptly.
Jun 29, 2026
FreePBX, the open-source IP PBX platform, has patched several critical vulnerabilities in its Endpoint Manager module that could allow attackers to bypass authentication and achieve remote code execution. Researchers from Horizon3.ai identified three high-severity flaws: CVE-2025-66039 (authentication bypass via forged Basic Auth headers when 'webserver' authorization is enabled), CVE-2025-61675 (multiple SQL injection vulnerabilities across several endpoints), and CVE-2025-61678 (arbitrary file upload enabling PHP webshell deployment). These vulnerabilities, when chained, allow unauthenticated attackers to gain full control over affected FreePBX instances, posing a significant risk to business communications infrastructure. The authentication bypass is not present in the default configuration but becomes exploitable if certain advanced settings are enabled. Attackers can exploit these flaws to access protected endpoints, manipulate the underlying SQL database, and upload malicious files for command execution. The vulnerabilities were responsibly disclosed to FreePBX maintainers, and patches have been released. Organizations using FreePBX, especially those with non-default authentication settings, are urged to update immediately to mitigate the risk of compromise.
Jun 29, 2026
OWASP's **API Security Top 10** identifies broken object-level and function-level authorization, excessive data exposure, security misconfiguration, and unsafe trust boundaries as leading API risks, warning that business logic abuse and operational gaps often turn ordinary endpoints into high-impact exposures. Those patterns were reflected in newly disclosed incidents involving both enterprise software and consumer-facing platforms, where low-privileged access was enough to reach data and functions intended for administrators or other users. In **CVE-2026-46515**, Frogman versions before `1.6.3` allowed users with only `PERM_READ` privileges to access administrative PBX data through MCP and HTTP APIs, including AMI manager secrets, outbound dial PINs, SIP secrets, backup paths, CDR history, and even root SSH connection commands; the flaw also enabled arbitrary execution of saved GraphQL queries and was rated **CVSS 9.3**. Separately, a bug bounty report on Target's Academy platform showed how two seemingly low-risk APIs could be chained to enumerate users and expose PII at scale, underscoring how weak authorization controls across interconnected endpoints can escalate routine API functionality into serious data disclosure.
Jul 19, 2026