CVE-2026-43925 Overview
CVE-2026-43925 is a mass assignment vulnerability [CWE-915] affecting FOSSBilling, a free, open-source billing and client management system. Versions prior to 0.8.0 expose the unauthenticated client self-registration endpoint to arbitrary field injection. Any visitor can assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, attackers apply group-restricted discount codes to receive unauthorized discounts. Version 0.8.0 contains a patch.
Critical Impact
Unauthenticated attackers manipulate registration parameters to join restricted client groups and redeem promo codes intended for privileged customers, causing financial loss to operators.
Affected Products
- FOSSBilling versions prior to 0.8.0
- FOSSBilling client self-registration endpoint
- Deployments with signup enabled and group-restricted promo codes
Discovery Timeline
- 2026-07-06 - CVE-2026-43925 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-43925
Vulnerability Analysis
The flaw resides in the client self-registration endpoint of FOSSBilling. The endpoint accepts user-supplied fields and binds them directly to the client entity without an allow-list of assignable attributes. This pattern, categorized as mass assignment [CWE-915], lets an attacker submit unexpected parameters alongside legitimate registration data. The attacker includes a client_group_id (or equivalent group field) in the sign-up request. The application persists the attacker-controlled value on the newly created account.
Membership in a client group then unlocks promo codes restricted to that group. The attacker checks out with a discounted price they should not qualify for. The impact is financial rather than technical, which aligns with the limited integrity impact reflected in the scoring vector.
Root Cause
The root cause is dynamic property assignment without a server-side allow-list. The registration handler does not distinguish between fields a prospective client may set (email, password, name) and fields controlled exclusively by administrators (group membership). The endpoint also lacks authorization checks that would validate group assignment against the requester's identity, which is anonymous at sign-up.
Attack Vector
Exploitation requires no authentication, no privileges, and no user interaction beyond crafting an HTTP request to the public registration route. The attacker submits a standard sign-up form and appends the group identifier field. After registration, the attacker applies a group-restricted promo code at checkout. See the GitHub Security Advisory GHSA-q4rq-9844-r9w2 for advisory details.
Detection Methods for CVE-2026-43925
Indicators of Compromise
- New client accounts whose group membership does not match the default assigned to self-registered users.
- Promo code redemptions by newly created accounts within minutes of registration.
- HTTP POST requests to the client registration endpoint containing group-related parameters such as client_group_id, group, or group_id.
- Discount totals or invoice adjustments that exceed thresholds tied to restricted promo campaigns.
Detection Strategies
- Review web server access logs for registration requests carrying unexpected form fields beyond the documented sign-up schema.
- Compare the client_group_id value on freshly created accounts against the platform default; flag deviations.
- Correlate account creation timestamps with promo code redemptions to identify abuse patterns.
Monitoring Recommendations
- Enable application-level audit logging for client creation events, capturing all submitted parameters.
- Alert on any registration payload containing group, role, or privilege fields.
- Track promo code usage per client group and investigate spikes from recently registered accounts.
How to Mitigate CVE-2026-43925
Immediate Actions Required
- Upgrade FOSSBilling to version 0.8.0 or later, which contains the official fix.
- Audit existing client accounts for unexpected group membership and reassign as needed.
- Review promo code redemption history for unauthorized discounts and reverse fraudulent invoices.
- Rotate active promo codes tied to restricted client groups after upgrading.
Patch Information
FOSSBilling 0.8.0 remediates the mass assignment flaw by restricting which fields the self-registration endpoint accepts. Refer to the FOSSBilling Security Advisory GHSA-q4rq-9844-r9w2 for release notes and upgrade instructions.
Workarounds
- Remove group restrictions from promo codes so group membership no longer confers discount eligibility.
- Disable client self-registration in the admin panel under Settings → Clients → Disable signup.
- Restrict access to the registration endpoint at the web server or WAF layer until the upgrade completes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
