CVE-2026-116257

HighCVSS 7.3

Published: 26/10/2026(UTC)Updated: 31/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.63%

50th percentile - higher than 50% of all known CVEs

Summary

In BillaBear up to 2025.01.03, the processInstall function in src/BillaBear/Controller/InstallController.php (Installation Handler component) lacks authentication. A remote attacker can exploit this, and a public exploit is already available. The vendor did not respond to the disclosure.

Risk Assessment

Missing authentication in the installation routine may allow a remote attacker to re-run the installer and take over or destroy the application configuration. Public exploit availability increases the risk.

Recommendation

Restrict access to the installation endpoint (e.g., at the web server or network level) and consider updating or applying vendor patches when available. Monitor access attempts to InstallController.

Other vulnerabilities in BillaBear

CVE-2026-31069High
BillaBear (all versions prior to Jan 2026) has a SQL Injection vulnerability in EventRepository. Metric filter names and aggregation properties are directly interpolated into SQL queries via sprintf() without sanitization. An authenticated attacker with ROLE_ACCOUNT_MANAGER can execute arbitrary SQL commands.

Original NVD description (English source)

A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS