FOSSBilling Flaws Enable Unauthenticated Access and Remote Code Execution

FOSSBilling disclosed two critical vulnerabilities that can be chained to give unauthenticated attackers administrative access and remote code execution on billing platforms used by hosting providers. CVE-2026-27604 is an authorization bypass in versions 0.5.4 through 0.7.2 that lets remote attackers reach privileged /api/system/* endpoints because the system API role is incorrectly mapped to the cron admin identity. CVE-2026-28496 is a Twig server-side template injection flaw affecting versions 0.1.0 through 0.7.2, where templates are rendered without a sandbox, exposing the Twig environment, API context, and the dependency injection container.

Researchers said the chain allows attackers to read and modify databases, enumerate administrators, create admin accounts, generate privileged API tokens, poison the Symfony cache used by the extension installer, and install a malicious module to execute code as the web server user. The exposure is significant because affected instances may hold customer PII, billing records, payment processor secrets, hosting control panel credentials, sessions, and API tokens. FOSSBilling patched both issues in version 0.8.0 and advised defenders to block external access to /api/system/*, restrict API access to trusted IPs, rotate admin and client API tokens, invalidate active sessions, reset high-privilege credentials, audit templates for malicious Twig expressions, and review logs for suspicious /api/system/ activity.