CVE-2026-23513 Overview
CVE-2026-23513 is an authorization bypass vulnerability in FOSSBilling, a free and open-source billing and client management system. Versions 0.7.2 and prior contain a query-construction flaw in client list endpoints that allows authenticated clients to bypass tenant scoping. Attackers can retrieve records belonging to other clients, including identifiers, transaction amounts, status fields, timestamps, and related metadata. The flaw resides in ServiceTransaction::getSearchQuery() and Order\Service::getSearchQuery(), where ungrouped OR clauses break the enforced client_id constraint. The issue is classified under [CWE-863: Incorrect Authorization] and was resolved in FOSSBilling version 0.8.0.
Critical Impact
Authenticated clients can read order and transaction data belonging to other tenants, exposing financial records and personally identifiable information across the multi-tenant boundary.
Affected Products
- FOSSBilling versions 0.7.2 and prior
- ServiceTransaction module (transaction search endpoints)
- Order\Service module (order search endpoints)
Discovery Timeline
- 2026-06-23 - CVE-2026-23513 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-23513
Vulnerability Analysis
The vulnerability stems from improper SQL query construction in two search functions: ServiceTransaction::getSearchQuery() and Order\Service::getSearchQuery(). Both functions build dynamic WHERE clauses by appending OR-based search and action filters directly to the query string. The developers did not wrap these OR clauses in parentheses, so SQL operator precedence evaluates OR conditions independently of the enforced client_id = ? constraint that scopes results to the current tenant. The resulting predicate effectively becomes client_id = ? AND field = X OR field = Y, which SQL parses as (client_id = ? AND field = X) OR (field = Y). The second branch returns records regardless of which client owns them, breaking multi-tenant isolation.
Root Cause
The root cause is missing parenthetical grouping around dynamically appended OR predicates. The authorization check is implemented at the query level rather than at a centralized access control layer. When user-controlled search filters are concatenated without isolation, the per-tenant constraint loses its binding effect on the broader predicate.
Attack Vector
An authenticated client account submits crafted search or filter parameters to the affected endpoints. The malicious request causes the OR-joined predicates to match rows owned by other tenants. The response returns cross-tenant data including order identifiers, transaction amounts, status, timestamps, and related fields. Exploitation requires only low privileges (PR:L) and network access to the application. See the GitHub Security Advisory GHSA-xcrv-cccw-r65v for full technical details.
Detection Methods for CVE-2026-23513
Indicators of Compromise
- Application logs showing unusually large result sets returned to client search or order list endpoints.
- Repeated requests from a single authenticated client containing varied search filter parameters targeting ServiceTransaction or Order endpoints.
- Database query logs containing WHERE clauses where client_id constraints are followed by ungrouped OR predicates.
Detection Strategies
- Audit web server access logs for client accounts retrieving order or transaction identifiers outside their own ID ranges.
- Enable verbose query logging in the FOSSBilling database backend and review WHERE clause structures for missing parentheses around OR filters.
- Compare API response payloads against the authenticated client identifier to detect cross-tenant leakage.
Monitoring Recommendations
- Monitor billing application endpoints for anomalous query volume per authenticated session.
- Alert on responses where returned client_id values do not match the requesting session's tenant identifier.
- Track failed and successful access to /api/client/order and transaction listing routes for behavioral baselining.
How to Mitigate CVE-2026-23513
Immediate Actions Required
- Upgrade FOSSBilling to version 0.8.0 or later, available via the GitHub Release 0.8.0.
- Review historical application and database logs for evidence of cross-tenant data access by client accounts.
- Rotate any sensitive identifiers or credentials that may have been exposed through transaction or order metadata.
Patch Information
The vendor released a fix in FOSSBilling 0.8.0 that wraps the OR-based search and action filters in parentheses, restoring SQL operator precedence so the client_id constraint binds correctly. Administrators should review the GitHub Security Advisory GHSA-xcrv-cccw-r65v for full remediation details and apply the upgrade promptly.
Workarounds
- Restrict access to the client portal to trusted users only until the patch is applied.
- Disable or block client-facing search and filter endpoints at the reverse proxy or web application firewall layer.
- Apply a manual code patch to ServiceTransaction::getSearchQuery() and Order\Service::getSearchQuery() to wrap OR filter clauses in parentheses if immediate upgrade is not feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
