CVE-2026-53645
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
FOSSBilling prior to version 0.8.0 contains a vulnerability that allows a low-privileged staff account to escalate privileges via the admin API. A user with the `staff.create_and_edit_staff` permission can call `/api/admin/staff/permissions_update` for their own account and set any permissions, bypassing role-based access control.
Risk Assessment
The risk is that an unprivileged staff member can gain persistent full control over the system, potentially leading to data theft, configuration changes, or client account takeover.
Recommendation
Upgrade FOSSBilling to version 0.8.0 or later immediately. If upgrading is not possible, restrict the `staff.create_and_edit_staff` permission to highly trusted staff only and block access to `/api/admin/staff/permissions_update` via a reverse proxy or WAF.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has `staff.create_and_edit_staff` can call `/api/admin/staff/permissions_update` targeting their own account and write any permission structure, bypassing the intended role-based access control boundary. Version 0.8.0 patches the issue. Some workarounds are available. Restrict the `staff.create_and_edit_staff` permission to only highly trusted staff members and/or use a reverse proxy or WAF to restrict access to `/api/admin/staff/permissions_update` to specific trusted roles.