CVE-2026-42331: FOSSBilling Auth Bypass Vulnerability

CVE-2026-42331 Overview

CVE-2026-42331 is a missing authorization vulnerability [CWE-306] in FOSSBilling, a free and open-source billing and client management platform. The Guest API invoice/update endpoint lacks the authorization check applied to other invoice-related endpoints. An unauthenticated attacker who knows an invoice hash can modify the payment gateway assigned to an unpaid invoice. Invoice hashes can leak through shared URLs, referrer headers, or email links. The flaw affects FOSSBilling versions prior to 0.8.0 and was patched in version 0.8.0.

Critical Impact
Unauthenticated attackers with knowledge of an invoice hash can tamper with the gateway_id on unpaid invoices, altering payment routing to any gateway already installed and configured by an administrator.

Affected Products

FOSSBilling versions prior to 0.8.0
FOSSBilling Guest API invoice/update endpoint
Systems where invoice_accessible_from_hash is enabled

Discovery Timeline

2026-07-06 - CVE-2026-42331 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-42331

Vulnerability Analysis

The vulnerability resides in the FOSSBilling Guest API invoice/update endpoint. Other invoice-related endpoints enforce an authorization check that verifies the requester has legitimate access to the invoice being modified. The invoice/update endpoint omits this check entirely. As a result, any unauthenticated caller who supplies a valid invoice hash can invoke the endpoint and modify the invoice's payment gateway.

The scope of the tampering is restricted. Attackers cannot redirect payments to an arbitrary external endpoint. The gateway_id value must reference a payment gateway that an administrator has already installed and configured within the FOSSBilling instance. The invoice_accessible_from_hash system setting further constrains exploitability by governing whether hash-based invoice access is permitted at all.

Root Cause

The root cause is a missing authorization control [CWE-306] on a Guest API route. Developers implemented authorization checks on comparable invoice endpoints but omitted the same guard on invoice/update. This inconsistency lets the endpoint accept and process state-changing requests from unauthenticated clients who present only an invoice hash as an implicit credential.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker first obtains an invoice hash. These hashes commonly leak through shared payment URLs, HTTP referrer headers when users navigate away from invoice pages, or forwarded email links. With the hash in hand, the attacker sends a crafted request to the Guest API invoice/update endpoint containing a different gateway_id. The server accepts the request and updates the unpaid invoice, changing which configured gateway will process the payment when the legitimate customer completes checkout.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-8755-w77f-3g7j for authoritative technical details.

Detection Methods for CVE-2026-42331

Indicators of Compromise

HTTP requests to the Guest API invoice/update endpoint originating from unauthenticated sessions or unexpected source IPs.
Unexplained changes to the gateway_id field on unpaid invoices in the FOSSBilling database.
Access log entries containing invoice hashes accompanied by POST or PUT requests to invoice update routes.
Customer reports of unexpected payment gateway selections during checkout.

Detection Strategies

Audit application access logs for calls to /api/guest/invoice/update and correlate with invoice modification events.
Enable database-level auditing on the invoices table to record changes to gateway_id on records with an unpaid status.
Compare invoice state before and after any Guest API interaction to identify unauthorized modifications.

Monitoring Recommendations

Forward FOSSBilling web server and application logs to a centralized log platform for retention and analysis.
Alert on repeated invoice hash access patterns from a single source, which may indicate hash enumeration or reuse.
Monitor egress referrer headers and shared link analytics for exposure of invoice hash URLs.

How to Mitigate CVE-2026-42331

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which contains the authorization fix.
Review unpaid invoices for unauthorized gateway_id modifications and reconcile against expected values.
Rotate or invalidate invoice hashes that may have been exposed through shared URLs, referrer headers, or email trails.

Patch Information

FOSSBilling version 0.8.0 contains the patch that adds the missing authorization check to the Guest API invoice/update endpoint. Administrators should upgrade immediately. See the GitHub Security Advisory GHSA-8755-w77f-3g7j for release details.

Workarounds

No official workarounds are documented by the FOSSBilling maintainers.
As a defense-in-depth measure, disable the invoice_accessible_from_hash system setting where operationally feasible to reduce exposure.
Restrict access to the Guest API invoice/update endpoint via a reverse proxy or web application firewall until the upgrade is completed.

bash

# Configuration example
# Upgrade FOSSBilling to the patched release
git fetch --tags
git checkout 0.8.0
composer install --no-dev --optimize-autoloader

# Optional: reduce exposure by disabling hash-based invoice access
# in the FOSSBilling admin settings
# System Settings -> invoice_accessible_from_hash = false