CVE-2026-111046: FOSSBilling Auth Bypass Vulnerability

CVE-2026-111046 Overview

CVE-2026-111046 is a missing authorization vulnerability [CWE-862] in FOSSBilling, an open source billing and client-management platform. The flaw affects versions 0.8.4 through 0.8.5 and is fixed in version 0.8.6. The hasManagePermission method fails open for inactive non-core modules because an early return on !isExtensionActive skips both module-access and manage_settings checks. A low-privileged staff account holding module-level extension access can abuse api/admin/extension/config_get and api/admin/extension/config_save against deactivated non-core modules. This residual path remained after the earlier authorization fix in CVE-2026-62962.

Critical Impact
Authenticated low-privileged staff can read decrypted extension secrets and overwrite stored extension configuration for deactivated non-core modules.

Affected Products

FOSSBilling 0.8.4
FOSSBilling 0.8.5
FOSSBilling versions prior to 0.8.6

Discovery Timeline

2026-10-19 - CVE-2026-111046 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-111046

Vulnerability Analysis

The vulnerability resides in the Extension module's hasManagePermission method within src/modules/Extension/Service.php. When a non-core extension is deactivated, the method returns early rather than evaluating the module-access and manage_settings permission checks. Any authenticated caller with module-level extension access can therefore reach getConfig and setConfig for deactivated non-core modules.

Invoking api/admin/extension/config_get returns the decrypted stored configuration, exposing retained secrets such as API tokens, SMTP credentials, or payment-gateway keys. Invoking api/admin/extension/config_save overwrites that stored configuration. Because the authorization check short-circuits before enforcement, the issue is not an input-validation flaw but a logic flaw in the permission boundary.

Root Cause

The root cause is an early-return pattern in hasManagePermission that treats an inactive extension as out of scope for authorization checks. The caller-side check in setConfig did not independently enforce manage_extensions, so the sensitive path remained reachable. This is the same class of defect previously addressed in CVE-2026-62962, but through a different code path.

Attack Vector

A low-privileged staff user authenticates to the FOSSBilling admin API over the network. The user calls api/admin/extension/config_get with the identifier of a deactivated non-core module to retrieve decrypted retained secrets. The user then calls api/admin/extension/config_save with crafted parameters to overwrite the stored configuration for that module.

php

     public function setConfig($data): bool
     {
+        // Intentional defense-in-depth: this method stores sensitive configuration,
+        // so authorization is enforced here independently of any caller-side checks.
         $this->hasManagePermission($data['ext']);
         $ext = $data['ext'];
         $this->getConfig($ext); // Creates new config if it does not exist in DB

Source: GitHub Commit 7a7a309. The patch adds an explicit hasManagePermission enforcement inside setConfig, ensuring authorization is validated regardless of extension active-state logic upstream.

Detection Methods for CVE-2026-111046

Indicators of Compromise

Admin API requests to api/admin/extension/config_get or api/admin/extension/config_save referencing module identifiers that are currently deactivated.
Access to extension configuration endpoints originating from staff accounts that do not hold the manage_settings or manage_extensions role.
Unexpected modification timestamps on stored extension configuration rows for non-core modules.

Detection Strategies

Review FOSSBilling admin API logs for extension/config_get and extension/config_save calls, correlating the target ext parameter with the module's active status at request time.
Compare the acting staff account's assigned permissions against the module targeted in each request; flag discrepancies.
Audit stored extension configuration tables for unexplained writes made during the exposure window on versions 0.8.4 through 0.8.5.

Monitoring Recommendations

Forward FOSSBilling application and web-server access logs to a centralized log platform and alert on access to extension configuration endpoints by non-administrative accounts.
Monitor for secret-rotation events on upstream services whose credentials are stored in FOSSBilling extension configuration.
Baseline normal admin API usage patterns and alert on first-seen staff access to deactivated-module configuration paths.

How to Mitigate CVE-2026-111046

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.6, which enforces hasManagePermission within setConfig and closes the residual authorization path.
Rotate any secrets stored in extension configurations for non-core modules, including API tokens, SMTP credentials, and payment-gateway keys.
Audit staff account permissions and remove module-level extension access from accounts that do not require it.

Patch Information

The fix is included in FOSSBilling Release v0.8.6 via GitHub Pull Request #4184 and commit 7a7a309. Full details are documented in GitHub Security Advisory GHSA-3g7m-ph2r-jhcx.

Workarounds

Restrict admin API access to the FOSSBilling instance via network controls, limiting it to trusted administrative networks.
Remove module-level extension permissions from low-privileged staff accounts until the upgrade to 0.8.6 is applied.
Where feasible, uninstall rather than deactivate non-core modules that retain sensitive configuration data.

bash

# Verify installed FOSSBilling version and upgrade
grep -R "'version'" /path/to/fossbilling/src/config.php

# Pull the fixed release
git fetch --tags
git checkout 0.8.6

# Review staff permissions in the admin console and remove
# 'manage_extensions' / module-level extension access from non-admin roles