CVE-2026-111056: FOSSBilling Information Disclosure Flaw

CVE-2026-111056 Overview

CVE-2026-111056 is an information disclosure vulnerability in FOSSBilling, an open source billing and client-management platform. The flaw affects versions 0.1.0 through 0.8.6 and allows unauthenticated attackers to enumerate registered client email addresses. The unauthenticated POST /api/guest/client/create endpoint returns a distinct unredacted error message when a submitted email already exists in the system. Attackers can compare response differences to determine whether a specific email belongs to a registered FOSSBilling client. The issue is tracked under CWE-200: Exposure of Sensitive Information and was fixed in version 0.8.7.

Critical Impact

Unauthenticated attackers can enumerate valid client email addresses through differential error responses, enabling targeted phishing and credential-stuffing campaigns against FOSSBilling customers.

Affected Products

• FOSSBilling versions 0.1.0 through 0.8.6
• FOSSBilling guest signup API endpoint POST /api/guest/client/create
• Fixed in FOSSBilling version 0.8.7

Discovery Timeline

• 2026-10-19 - CVE-2026-111056 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-111056

Vulnerability Analysis

The vulnerability resides in the FOSSBilling guest signup workflow. When a client submits a registration request to POST /api/guest/client/create, the backend calls Client\Service::clientAlreadyExists to check for duplicate records. If the submitted email matches an existing client, Box\Mod\Client\Api\Guest::create returns an exception message that explicitly indicates the email is already registered.

The API serializes this exception message into the HTTP response without redaction. Attackers observe different responses for existing versus non-existing emails, converting the signup endpoint into a user-enumeration oracle. Because the endpoint is unauthenticated, no credentials or prior access are required to exploit the flaw.

The enumeration primitive supports downstream attacks. Harvested email lists feed targeted phishing campaigns, password-spray attempts, and credential-stuffing against known FOSSBilling customers. The impact is limited to confidentiality of account identifiers, consistent with the CWE-200 classification.

Root Cause

The signup flow does not uniformly respond to duplicate-email conditions. Instead of returning a generic success message or a neutral error, the API surface propagates the internal clientAlreadyExists exception verbatim. There is no rate limiting bound to the email parameter, so an attacker can test large candidate lists against the oracle.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends sequential or scripted POST /api/guest/client/create requests against a target FOSSBilling instance, each containing a candidate email. The attacker parses the response body or status, classifying each candidate as registered or not. The following patch excerpt shows the mitigation applied upstream in release 0.8.7.

'staff_password_reset_confirm_ip' => ['policy' => 'fixed_window', 'limit' => 20, 'interval' => '60 seconds'],
'staff_password_reset_confirm_post_ip' => ['policy' => 'fixed_window', 'limit' => 20, 'interval' => '60 seconds'],
'client_signup' => ['policy' => 'fixed_window', 'limit' => 5, 'interval' => '1 hour'],
+'client_signup_email' => ['policy' => 'fixed_window', 'limit' => 5, 'interval' => '1 hour'],
'guest_ticket_create' => ['policy' => 'fixed_window', 'limit' => 3, 'interval' => '1 hour'],

Source: FOSSBilling commit 19f41ff. The patch introduces a per-email rate limiter (client_signup_email) in src/library/FOSSBilling/Security/RateLimiter.php to throttle enumeration attempts.

Detection Methods for CVE-2026-111056

Indicators of Compromise

• High-volume unauthenticated POST requests to /api/guest/client/create from a single source IP or distributed botnet.
• Repeated signup attempts cycling through distinct email addresses with identical or missing payload fields.
• Elevated 4xx responses from the guest signup endpoint referencing duplicate-client errors.

Detection Strategies

• Correlate web server access logs for sequential requests to /api/guest/client/create with varying email parameters over short time windows.
• Alert on anomalous ratios between signup requests and successful registrations, indicating enumeration rather than legitimate signups.
• Inspect application logs for repeated clientAlreadyExists exception traces originating from the guest API.

Monitoring Recommendations

• Deploy web application firewall (WAF) rules that rate-limit requests to the guest signup endpoint by source IP and session.
• Forward FOSSBilling application and web server logs to a centralized SIEM for correlation and long-term analysis.
• Monitor outbound reputation feeds for FOSSBilling customer emails appearing in phishing or credential-stuffing campaigns.

How to Mitigate CVE-2026-111056

Immediate Actions Required

• Upgrade FOSSBilling to version 0.8.7 or later, which contains the official fix for CVE-2026-111056.
• Audit web server and application logs for prior enumeration activity against /api/guest/client/create.
• Notify clients whose emails may have been exposed and recommend heightened vigilance against phishing.

Patch Information

The fix is published in FOSSBilling Release v0.8.7. The hardening landed through Pull Request #4234 and commit 19f41ff. Full details are documented in GitHub Security Advisory GHSA-x4mh-g4pc-wfc5. The patch adds a per-email rate limiter and neutralizes the differential error response.

Workarounds

• Place the FOSSBilling instance behind a reverse proxy or WAF that enforces strict rate limits on /api/guest/client/create.
• Restrict access to the guest signup endpoint to known client IP ranges where business workflows allow.
• Temporarily disable public guest registration until the upgrade to 0.8.7 is complete.

# Example nginx rate limit for the FOSSBilling guest signup endpoint
limit_req_zone $binary_remote_addr zone=fb_signup:10m rate=5r/m;

location = /api/guest/client/create {
    limit_req zone=fb_signup burst=5 nodelay;
    proxy_pass http://fossbilling_backend;
}