CVE-2026-43918
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In FOSSBilling prior to version 0.8.0, suspending or deactivating an account does not invalidate existing authenticated sessions. The session loader does not check the account status, allowing a suspended user to retain full access until session expiry.
Risk Assessment
The organization is at risk of unauthorized system access by suspended or deactivated users, potentially leading to data confidentiality breaches and system integrity issues.
Recommendation
Immediately upgrade FOSSBilling to version 0.8.0 or later, which invalidates sessions upon account suspension/deactivation.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing authenticated sessions are not invalidated. The session identity loaders in src/di.php (loggedin_client and loggedin_admin) only reject sessions if the backing account record no longer exists in the database. They do not verify that the account's status is still active. This allows a suspended or deactivated user to retain full access until their session naturally expires. This issue has been fixed in version 0.8.0.