CVE-2026-27708: FOSSBilling Auth Bypass Vulnerability

CVE-2026-27708 Overview

CVE-2026-27708 is an Insecure Direct Object Reference (IDOR) vulnerability in FOSSBilling, a free, open-source billing and client management system. The flaw resides in the Servicecustom Client API's __call method, which accepts an order_id parameter and fetches the associated order without verifying that the authenticated client owns it. Any authenticated client can enumerate sequential order IDs to retrieve custom service data belonging to other clients. Affected versions include FOSSBilling 0.7.2 and prior. The issue is fixed in version 0.8.0.

Critical Impact
Authenticated clients can read other clients' personally identifiable information (PII) — name, email, phone, address, company details, VAT number — and custom service configuration data, resulting in a cross-tenant confidentiality breach.

Affected Products

FOSSBilling versions 0.7.2 and prior
FOSSBilling Servicecustom Client API component
Self-hosted FOSSBilling deployments exposing client portals to authenticated users

Discovery Timeline

2026-06-24 - CVE-2026-27708 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-27708

Vulnerability Analysis

The vulnerability is classified as [CWE-284] Improper Access Control, specifically manifesting as an Insecure Direct Object Reference. FOSSBilling exposes a Client API surface that authenticated customers can call to manage their own orders and services. The Servicecustom API endpoint relies on the __call magic method to dispatch requests and load order context using a caller-supplied order_id parameter.

The dispatcher loads the order record directly from storage using the supplied identifier. It then returns the associated custom service details without enforcing an ownership check against the authenticated client identity. As a result, authorization is effectively reduced to authentication. Any logged-in client becomes capable of reading records that belong to other clients.

The data returned includes structured PII fields and service configuration values. Sensitive elements include full name, email address, phone number, postal address, company name, and VAT number. Custom service configuration data may also disclose provisioning details specific to the targeted client.

Root Cause

The root cause is a missing authorization check in the Servicecustom Client API __call method. The code retrieves an order by primary key but never validates that the order's client_id matches the session-authenticated client. This separation of authentication from per-object authorization is the defining pattern of IDOR vulnerabilities.

Attack Vector

Exploitation requires only a valid low-privileged client account on a vulnerable FOSSBilling instance. The attacker iterates sequential integer order_id values against the Servicecustom API. Because order identifiers are predictable and monotonic, full enumeration of cross-client records is trivial. No user interaction from the victim is required, and the attack is fully remote over the network.

No verified public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory GHSA-p36w-9x66-488j for technical details from the maintainers.

Detection Methods for CVE-2026-27708

Indicators of Compromise

Authenticated client sessions issuing high-volume requests to the Servicecustom Client API with incrementing order_id values.
Single client accounts accessing order identifiers that do not appear in their own order history.
HTTP 200 responses to Servicecustom calls containing client PII fields not associated with the requesting account.

Detection Strategies

Review FOSSBilling web server access logs for sequential order_id parameter enumeration patterns from a single authenticated session.
Correlate application-level audit logs of order access against the authenticated client identity to identify ownership mismatches.
Apply rate limiting and anomaly detection on Client API endpoints, alerting when a single account fetches an unusual number of distinct orders.

Monitoring Recommendations

Forward FOSSBilling application and webserver logs to a centralized SIEM or data lake for retention and correlation.
Build a detection rule that flags any client session retrieving order records whose client_id differs from the session principal.
Monitor outbound data volumes from the billing application for spikes consistent with bulk PII exfiltration.

How to Mitigate CVE-2026-27708

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which contains the fix.
Audit historical access logs for evidence of order_id enumeration against the Servicecustom Client API prior to patching.
Rotate any sensitive data or credentials that may have been exposed and notify affected clients in line with applicable data breach regulations.

Patch Information

The maintainers fixed the issue in FOSSBilling 0.8.0 by enforcing ownership validation on order lookups within the Servicecustom Client API. Download the patched release from the FOSSBilling 0.8.0 Release Notes. Full advisory text is available in the GitHub Security Advisory GHSA-p36w-9x66-488j.

Workarounds

If immediate upgrade is not possible, restrict access to the FOSSBilling client portal using network controls such as IP allowlists or VPN-only access.
Temporarily disable the Servicecustom module if it is not in active use to remove the vulnerable code path.
Apply a web application firewall (WAF) rule to block requests that enumerate order_id values at high rates from a single authenticated session.

bash

# Configuration example: upgrade FOSSBilling to the patched release
cd /var/www/fossbilling
php composer.phar self-update
git fetch --tags
git checkout 0.8.0
php composer.phar install --no-dev --optimize-autoloader