CVE-2026-43925
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In FOSSBilling prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. This enables attackers to apply group-restricted promo codes and receive unauthorized discounts.
Risk Assessment
The risk involves potential financial losses and violation of pricing policies due to unauthorized discounts obtained by attackers.
Recommendation
Immediately upgrade to version 0.8.0 or apply a workaround by removing group restrictions from promo codes or disabling client self-registration in system settings.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).