CVE-2026-33543: FOSSBilling Auth Bypass Vulnerability

CVE-2026-33543 Overview

CVE-2026-33543 is an authentication bypass vulnerability in FOSSBilling, a free open-source billing and client management system. Versions 0.7.2 and prior expose the /api/guest/staff/create endpoint, intended only for initial administrator bootstrap. A flawed admin-existence check allows unauthenticated attackers to invoke the endpoint after an administrator already exists. The guard uses is_countable() on a value that returns a Model_Admin object or null, causing the check to always evaluate as true. Attackers can create a new administrator account and immediately authenticate with full privileges. The issue is resolved in version 0.8.0.

Critical Impact
Unauthenticated attackers can create privileged administrator accounts on exposed FOSSBilling instances and gain full control of the billing platform.

Affected Products

FOSSBilling versions 0.7.2 and prior
FOSSBilling guest API endpoint /api/guest/staff/create
Fixed in FOSSBilling version 0.8.0

Discovery Timeline

2026-06-24 - CVE-2026-33543 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-33543

Vulnerability Analysis

The vulnerability stems from an incorrect type assumption in the admin-existence guard protecting the bootstrap endpoint. FOSSBilling exposes /api/guest/staff/create so the very first administrator can be created without authentication. After bootstrap, the endpoint should refuse subsequent requests. The guard logic instead applies is_countable() to a value that is either a Model_Admin object or null. Neither value is countable, so the check evaluates incorrectly and the endpoint stays reachable. An unauthenticated attacker can submit a crafted request with new administrator credentials and immediately log in. The result is a full authentication bypass, mapped to [CWE-288] Authentication Bypass Using an Alternate Path or Channel.

Root Cause

The root cause is a misuse of PHP's is_countable() function in a security-critical guard. The function returns true only for arrays or objects implementing Countable. Applying it to a single Model_Admin instance or null always returns false, but the surrounding logic interprets the result as confirmation that no admin exists. The bootstrap-only contract of the endpoint is therefore never enforced once an administrator is present in the database.

Attack Vector

The attack is fully remote, requires no privileges, and needs no user interaction. An attacker who can reach the FOSSBilling HTTP interface sends a POST request to /api/guest/staff/create containing a chosen email, password, and name. The flawed guard accepts the request, the new administrator row is inserted, and the attacker authenticates against the standard admin login flow. From that session the attacker can manipulate customers, invoices, payment configuration, and server credentials stored in FOSSBilling. Public exposure of the application makes opportunistic mass exploitation feasible. No proof-of-concept code is required to describe the issue beyond the advisory; see the GitHub Security Advisory GHSA-28mh-j262-q49w for vendor technical details.

Detection Methods for CVE-2026-33543

Indicators of Compromise

HTTP POST requests to /api/guest/staff/create from external sources after initial deployment
New rows in the FOSSBilling admin table that do not correspond to known operator onboarding
Successful administrator logins from unfamiliar IP addresses or user agents shortly after a guest API call
Outbound webhook, SMTP, or payment-gateway configuration changes performed by recently created admin accounts

Detection Strategies

Inspect web server access logs for any request path containing /api/guest/staff/create and treat each hit on a production instance as suspicious.
Compare administrator accounts in the database against an approved roster and alert on additions outside change-control windows.
Correlate guest API requests with subsequent /bb-admin authentication events from the same source IP.

Monitoring Recommendations

Forward FOSSBilling web and application logs to a centralized logging platform for retention and query.
Enable alerting on HTTP 200 responses from /api/guest/staff/* endpoints on hosts that have completed bootstrap.
Monitor for privileged configuration changes, such as new payment gateways or staff role modifications, performed by accounts created within the last 24 hours.

How to Mitigate CVE-2026-33543

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, where the admin-existence check is fixed.
Audit the admin table and remove any administrator accounts that cannot be attributed to a legitimate operator.
Rotate passwords and API tokens for all remaining administrator accounts after the upgrade.
Review and revoke any payment-gateway, SMTP, or server credentials stored in the FOSSBilling configuration.

Patch Information

The FOSSBilling maintainers released the fix in version 0.8.0. The patched code replaces the is_countable() guard with a check that correctly determines whether an administrator already exists. Release notes and download artifacts are available at the FOSSBilling 0.8.0 Release. Refer to the GitHub Security Advisory GHSA-28mh-j262-q49w for full disclosure details.

Workarounds

Block external access to /api/guest/staff/create at the reverse proxy or web application firewall layer until the upgrade is complete.
Restrict access to the FOSSBilling admin interface and guest API to trusted IP ranges using network ACLs.
If an upgrade is not immediately possible, take the application offline rather than leave the endpoint reachable from the internet.

bash

# Example nginx block to deny the vulnerable endpoint until patching
location = /api/guest/staff/create {
    deny all;
    return 403;
}