CVE-2026-53647
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
In FOSSBilling versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record.
Risk Assessment
The risk involves exposure of business-sensitive data such as pricing tiers, feature flags, rate limits, or access scope data that billing administrators may store in `custom_*` fields.
Recommendation
Upgrade to version 0.8.0 immediately. As a workaround, avoid storing sensitive data in `custom_*` API key fields, monitor API logs for suspicious calls to `/api/guest/serviceapikey/get_info`, and disable the Serviceapikey module if not in active use.
Original NVD description (English source)
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. Version 0.8.0 patches the issue. Some workarounds are available. Administrators can avoid storing sensitive data in `custom_*` API key configuration fields, monitor API logs for suspicious calls to `/api/guest/serviceapikey/get_info`, and/or disable the Serviceapikey module if not in active use.