CVE-2026-53642 PUBLISHED

FOSSBilling: Unverified clients can access client-area pages when email confirmation is required

Assigner: GitHub_M
Reserved: 09.06.2026 Published: 06.07.2026 Updated: 07.07.2026

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enabled, a logged-in client with an unverified email address (email_approved = 0) can access all client-area pages (e.g. /client/balance, /client/order/list, /client/invoice) and read real account data, including wallet balances and transaction history. The API-side enforcement correctly restricts unverified clients to only profile-related endpoints, but the page-side enforcement is overly permissive, allowing any request whose path starts with /client. Version 0.8.0 contains a fix. No known workarounds that don't involve modifying the source code are available.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor FOSSBilling
Product FOSSBilling
Versions
  • Version >= 0.5.6, < 0.8.0 is affected

References

Problem Types

  • CWE-863: Incorrect Authorization CWE