CVE-2026-43920: FOSSBilling Auth Bypass Vulnerability

CVE-2026-43920 Overview

CVE-2026-43920 is a missing authentication vulnerability [CWE-306] in FOSSBilling, a free open-source billing and client management system. Versions 0.5.4 through 0.7.2 expose the /run-patcher maintenance endpoint without any authentication check. Unauthenticated remote attackers can invoke privileged maintenance operations by sending a simple HTTP GET request. Triggered routines modify configuration files, execute database schema changes, perform filesystem mutations, and clear caches. The issue is fixed in version 0.8.0.

Critical Impact
Remote unauthenticated attackers can trigger destructive maintenance routines, including ALTER TABLE, DROP TABLE, and UPDATE statements, session invalidation, and admin token regeneration, resulting in denial of service and inconsistent database state.

Affected Products

FOSSBilling 0.5.4 through 0.7.2
FOSSBilling billing and client management system
Fixed in FOSSBilling 0.8.0

Discovery Timeline

2026-06-26 - CVE-2026-43920 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-43920

Vulnerability Analysis

The /run-patcher endpoint in FOSSBilling executes privileged maintenance logic intended for administrator or CLI use. The endpoint lacks administrator authentication, Cross-Site Request Forgery (CSRF) validation, and CLI context enforcement. Any unauthenticated network client can invoke it with an HTTP GET request. The patcher performs configuration migrations, executes database patches (including ALTER TABLE, DROP TABLE, and UPDATE statements), applies filesystem deletions and renames, and clears caches. Repeated or concurrent invocations may leave the database in an inconsistent state. Certain patches remain destructive when re-executed against an already-patched instance, such as patch 53, which regenerates tokens for every admin and client account and invalidates active sessions.

Root Cause

The root cause is missing authentication on a security-sensitive function [CWE-306]. The /run-patcher route is registered as a public HTTP endpoint but performs operations that require administrator privileges. No CSRF token, session check, or CLI-only guard restricts callers.

Attack Vector

Exploitation requires only network access to the FOSSBilling web instance. An attacker sends an unauthenticated HTTP GET request to /run-patcher. The server responds by executing all pending patch routines. Repeated requests can force token rotation and session invalidation on active administrators, producing denial-of-service conditions. See the GitHub Security Advisory GHSA-prx6-m547-rfmg for the maintainer analysis.

Detection Methods for CVE-2026-43920

Indicators of Compromise

HTTP GET requests to /run-patcher originating from unauthenticated or unexpected client IP addresses.
Unexplained forced logouts of administrator and client accounts caused by session invalidation.
Unexpected regeneration of API tokens for admin and client accounts, indicative of patch 53 execution.
Database schema changes or cache-clearing events with no corresponding administrator activity in audit logs.

Detection Strategies

Alert on any request path matching /run-patcher in web server access logs and reverse proxy logs.
Correlate /run-patcher requests with subsequent database schema modification events (ALTER TABLE, DROP TABLE).
Monitor authentication logs for mass session invalidation or token regeneration events across accounts.

Monitoring Recommendations

Enable verbose access logging on the web server hosting FOSSBilling and forward logs to a centralized SIEM.
Track FOSSBilling version strings across deployments to identify instances running 0.5.4 through 0.7.2.
Set threshold-based alerts on repeated GET requests to maintenance endpoints from a single source.

How to Mitigate CVE-2026-43920

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which enforces authentication on the patcher endpoint.
Restrict network access to /run-patcher at the reverse proxy or web application firewall until the upgrade is applied.
Review database integrity and application configuration files for signs of unauthorized patch execution.
Rotate administrator credentials and API tokens if unauthorized /run-patcher invocations are detected.

Patch Information

The maintainers fixed CVE-2026-43920 in FOSSBilling 0.8.0. Refer to the FOSSBilling 0.8.0 Release Notes and the GitHub Security Advisory GHSA-prx6-m547-rfmg for full remediation details.

Workarounds

Block external access to the /run-patcher URL path at the reverse proxy, load balancer, or WAF layer.
Restrict the FOSSBilling admin area and maintenance endpoints to trusted IP ranges through network access control lists.
Require an authenticated administrator session or CLI invocation for any patch execution until the upgrade is deployed.

bash

# Configuration example: block /run-patcher at the nginx reverse proxy
location = /run-patcher {
    deny all;
    return 403;
}