CVE-2026-27604: FOSSBilling Auth Bypass Vulnerability

CVE-2026-27604 Overview

CVE-2026-27604 is an authorization bypass vulnerability in FOSSBilling, an open-source billing and client management system. The flaw exists in the API role handling logic in versions 0.5.4 through 0.7.x. Unauthenticated attackers can reach privileged /api/system/* endpoints because the system role resolves to the cron admin identity. This allows invocation of admin API methods without valid credentials, an active session, or a CSRF token. The issue is fixed in version 0.8.0.

Critical Impact
Remote, unauthenticated attackers can execute administrative API methods on exposed FOSSBilling instances, leading to full application compromise [CWE-200].

Affected Products

FOSSBilling versions 0.5.4 through 0.7.x
FOSSBilling deployments exposing /api/system/* endpoints to untrusted networks
Fixed in FOSSBilling 0.8.0

Discovery Timeline

2026-06-23 - CVE-2026-27604 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-27604

Vulnerability Analysis

The vulnerability resides in FOSSBilling's API authentication and role resolution path. When the API router processes requests targeting the /api/system/* namespace, the system role is mapped to the cron admin identity. The application treats requests reaching this namespace as originating from a trusted internal scheduler. As a result, the authentication, session, and CSRF checks applied to standard admin or client API requests are not enforced on these endpoints.

An attacker reaching the /api/system/* path over the network inherits administrator-equivalent privileges. Because no credentials are required, exploitation is trivial against any FOSSBilling instance that exposes the API path to untrusted networks. The flaw is categorized as Authorization Bypass and information exposure [CWE-200]. According to the VulnCheck analysis referenced in the advisory, the bypass can be chained with server-side template injection to achieve remote code execution.

Root Cause

The root cause is missing authorization enforcement on requests resolved to the system role. The role exists to support internal cron-based administrative tasks but is reachable through the public HTTP interface. No source IP restriction or shared secret is required for the role mapping to take effect, so any external client can assume cron admin privileges by targeting the namespace.

Attack Vector

Exploitation requires only network access to the FOSSBilling HTTP interface. The attacker sends crafted requests to /api/system/* endpoints, invoking administrative API methods directly. No authentication tokens, session cookies, or CSRF tokens are required. Successful exploitation grants the attacker the ability to read sensitive configuration, modify application state, and per the chained technique described in the linked VulnCheck Blog Analysis, reach a server-side template injection sink that yields remote code execution.

For technical details on the request flow and the SSTI chain, see the GitHub Security Advisory GHSA-57mv and GitHub Security Advisory GHSA-78x5.

Detection Methods for CVE-2026-27604

Indicators of Compromise

HTTP requests to any path matching /api/system/* from external or untrusted source IP addresses.
Successful 200-class responses to /api/system/* requests lacking valid admin session cookies or API tokens.
Unexpected administrative actions in FOSSBilling audit logs without corresponding admin login events.
New or modified configuration entries, extensions, or template files outside scheduled change windows.

Detection Strategies

Inspect reverse proxy and web server access logs for requests to /api/system/ paths and alert on any external sources.
Correlate FOSSBilling application logs with web access logs to identify admin API calls without preceding authentication.
Hunt for outbound network connections initiated by the PHP worker process following /api/system/* requests, which may indicate post-exploitation SSTI activity.

Monitoring Recommendations

Enable verbose API request logging and forward logs to a centralized analytics platform for retention and search.
Monitor file integrity on the FOSSBilling web root, configuration directory, and template directory for unauthorized changes.
Alert on creation of new administrative accounts or API tokens within FOSSBilling.

How to Mitigate CVE-2026-27604

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which patches the role resolution flaw.
Block external access to /api/system/* at the reverse proxy or web application firewall (WAF) layer.
Rotate all admin and client API tokens, invalidate active sessions, and reset high-privilege credentials.
Review API request logs for prior /api/system/ access and treat any external hits as a potential incident.

Patch Information

FOSSBilling version 0.8.0 contains the official fix. Refer to the GitHub Security Advisory GHSA-57mv and GitHub Security Advisory GHSA-78x5 for the complete patch notes and upgrade guidance.

Workarounds

Configure the reverse proxy or WAF to deny all requests matching /api/system/* from public networks.
Restrict API access to trusted source IP addresses using the api.allowed_ips configuration directive.
Place the FOSSBilling admin interface behind a VPN or IP allowlist until the upgrade is completed.
Disable or isolate any internet-exposed FOSSBilling instance that cannot be immediately patched.

bash

# Example NGINX configuration to block external access to /api/system/*
location ~ ^/api/system/ {
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    deny all;
    return 403;
}