Loading vulnerability…
Unauthenticated Administrative API Access in FOSSBilling
CVE-2026-27604 is an authorization bypass in FOSSBilling versions 0.5.4 through versions preceding 0.8.0. The isRoleAllowed() API role checker constructs an exception for invalid roles but fails to throw it. This allows unauthenticated callers to select the system API role, which resolves to the privileged ROLE_CRON identity and bypasses per-module permission checks. Attackers can consequently invoke administrative API methods without valid credentials, an authenticated session, or a CSRF token.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated attackers can access administrative API functionality under the privileged cron identity, bypassing authentication and per-module authorization controls. When combined with CVE-2026-28496, an unsandboxed Twig template-rendering vulnerability, this access enables arbitrary database queries, disclosure of customer information and administrative or payment credentials, creation of administrator accounts, extension-cache poisoning, and ultimately remote code execution as the web server user. Those database and code-execution outcomes are demonstrated consequences of the two-vulnerability chain, not independently established effects of the authorization bypass alone.
If you can’t patch tonight, do this now.
Block external access to /api/system/* at the reverse proxy or WAF, and restrict API access to trusted source IP addresses using api.allowed_ips. Rotate administrator and client API tokens, invalidate active sessions, and reset high-privilege credentials. Review API request logs for suspicious /api/system/ access and treat suspicious activity as a potential incident. These measures supplement, rather than replace, upgrading.
Patch, then assume compromise.
Upgrade FOSSBilling to version 0.8.0 or later. Version 0.8.0 is the first release containing the authorization fix and the fix for the associated CVE-2026-28496 template-rendering vulnerability. The authorization fix restores the missing throw statement in isRoleAllowed().
1 exploit validated by Mallory's analysis.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.