CVE-2026-53644
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
FOSSBilling versions 0.5.3 through 0.7.2 allow authenticated clients to read and reset API key secrets for orders that are no longer active (e.g., suspended, canceled). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper existing in the `Serviceapikey` module and the frontend UI correctly gating access on active orders.
Risk Assessment
The organization is at risk of unauthorized access to API keys for inactive orders, potentially leading to data leakage or unauthorized service usage by former clients.
Recommendation
Upgrade FOSSBilling to version 0.8.0 or later immediately. If upgrading is not possible, uninstall the `Serviceapikey` module or configure a reverse proxy/WAF to block access to the vulnerable API endpoints.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an `active` state (e.g., `suspended`, `canceled`). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper already existing in the `Serviceapikey` module and the frontend UI correctly gating access on `order.status == 'active'`. Version 0.8.0 contains a fix. Some workarounds are available. If the `Serviceapikey` module is not needed, uninstall it to remove the affected endpoints. One may also use a reverse proxy or WAF to restrict access to `/api/client/order/service` and `/api/client/serviceapikey/reset` based on application-level order-state logic.