FOSSBilling vulnerabilities
We track 14 vulnerabilities in FOSSBilling products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest FOSSBilling vulnerabilities
- 8.4 High severity
FOSSBilling: Improper Neutralization of Input During Web Page Generation
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_su
- 7.7 High severity
FOSSBilling: Weak Password Recovery Mechanism for Forgotten Password
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired reset request), subsequent calls to the `reset_password` guest
- 8.5 High severity
FOSSBilling: Improper Privilege Management
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff u
- 8.6 High severity
FOSSBilling: Authorization Bypass Through User-Controlled Key
FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an `active` state (e.g., `suspended`, `canceled`).
- 8.7 High severity
FOSSBilling: Exposure of Sensitive Information to an Unauthorized Actor
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_always_access` module flag
- 8.9 High severity
FOSSBilling: Improper Control of Generation of Code
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are w
- 8.7 High severity
FOSSBilling is a free, open-source billing and client management system.
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing authenticated sessions are not invalidated. The session identity loaders in src/di.p
- 9.2 Critical severity
FOSSBilling: Missing Authentication for Critical Functionality
FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark
- 7.7 High severity
FOSSBilling: Missing Authentication for Critical Functionality
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge
- 9.3 Critical severity
FOSSBilling: Authentication Bypass Using an Alternate Path or Channel
FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains us
- 7.1 High severity
FOSSBilling: Improper Access Control
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an order_id parameter and fetches the associated order without verifying the authenticated client owns it
- 7.1 High severity
FOSSBilling: Incorrect Authorization
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In Service
- 9.4 Critical severity
FOSSBilling: Improper Neutralization of Special Elements Used in a Template Engine
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. Administrators with access to features that render Twig templates (ema
- 10.0 Critical severity
FOSSBilling: Exposure of Sensitive Information to an Unauthorized Actor
FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged `/api/system/*` endpoints. Because `syst