CyberRota Analysis
AI-GeneratedLow-privileged staff accounts in FOSSBilling versions prior to 0.8.0 can access sensitive data through admin API endpoints that lack proper authorization checks, posing a risk of data exposure. Organizations using this billing and client management system should prioritize upgrading to version 0.8.0 or implementing workarounds, such as restricting access to sensitive endpoints via a reverse proxy or WAF, to mitigate potential data breaches. This vulnerability particularly affects environments with multiple staff accounts that may inadvertently access restricted information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admin API endpoints that lack permission checks. While sibling write endpoints correctly enforce fine-grained permissions, the corresponding read endpoints have no authorization guards. Version 0.8.0 contains a fix. Some workarounds are available. Restrict staff accounts to only those who need access to sensitive data and/or use a reverse proxy or WAF to restrict access to the affected endpoints.