CVE-2026-43927
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In FOSSBilling prior to version 0.8.0, a race condition in the cart checkout flow allows an authenticated client to apply a promo code beyond its configured maximum uses. By sending concurrent checkout requests, a client can obtain unlimited discounted or free orders from a single-use or limited-use promo code.
Risk Assessment
The organization faces financial losses due to uncontrolled application of promo codes, potentially leading to excessive discounts or free orders, and compromising the integrity of the billing system.
Recommendation
Immediately upgrade FOSSBilling to version 0.8.0 or later. If upgrading is not possible, temporarily disable all promo codes and monitor the `promo` table for `used` values exceeding `maxuses`.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the cart checkout flow allows an authenticated client to apply a promo code beyond its configured maximum uses. By sending concurrent checkout requests before any single request completes the usage increment, a client can obtain unlimited discounted or free orders from a single-use or limited-use promo code. Version 0.8.0 patches the issue. Some workarounds are available. Disable promo codes entirely until a patch is available or monitor the `promo` table for `used` values exceeding `maxuses` and manually review affected orders.