CVE-2026-53642
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In FOSSBilling versions 0.5.6 through 0.7.2, when the 'Require Email Confirmation' setting is enabled, a logged-in client with an unverified email address can access all client-area pages, such as wallet balance and transaction history. The API-side enforcement works correctly, but the page-side enforcement is overly permissive, allowing any request starting with '/client'.
Risk Assessment
The organization risks exposure of sensitive financial client data, including wallet balances and transaction history, which could lead to privacy breaches and loss of trust.
Recommendation
Immediately update FOSSBilling to version 0.8.0, which contains a fix for this vulnerability.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enabled, a logged-in client with an unverified email address (`email_approved = 0`) can access all client-area pages (e.g. `/client/balance`, `/client/order/list`, `/client/invoice`) and read real account data, including wallet balances and transaction history. The API-side enforcement correctly restricts unverified clients to only profile-related endpoints, but the page-side enforcement is overly permissive, allowing any request whose path starts with `/client`. Version 0.8.0 contains a fix. No known workarounds that don't involve modifying the source code are available.