CVE-2026-53642: FOSSBilling Auth Bypass Vulnerability

CVE-2026-53642 Overview

CVE-2026-53642 is a broken access control vulnerability [CWE-863] in FOSSBilling, a free, open-source billing and client management system. The flaw exists in versions 0.5.6 through 0.7.2 when the Require Email Confirmation setting is enabled. Authenticated clients with unverified email addresses (email_approved = 0) can access client-area pages that should be restricted to verified accounts. Affected endpoints include /client/balance, /client/order/list, and /client/invoice, exposing wallet balances and transaction history. Version 0.8.0 contains the fix.

Critical Impact
Unverified authenticated clients can bypass email confirmation controls and read sensitive financial data including wallet balances and full transaction history through client-area pages.

Affected Products

FOSSBilling versions 0.5.6 through 0.7.2
FOSSBilling deployments with Require Email Confirmation enabled
Fixed in FOSSBilling version 0.8.0

Discovery Timeline

2026-07-06 - CVE-2026-53642 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-53642

Vulnerability Analysis

The vulnerability stems from inconsistent access control enforcement between the API layer and the page-rendering layer in FOSSBilling. The API-side correctly restricts unverified clients (email_approved = 0) to profile-related endpoints only. The page-side enforcement is overly permissive and allows any request whose path begins with /client.

This inconsistency creates a business logic flaw. An attacker who registers an account but never confirms their email can still browse the entire client area. They can read wallet balances at /client/balance, view order history at /client/order/list, and retrieve invoice data at /client/invoice. The email confirmation gate becomes ineffective for protecting the client dashboard.

The issue applies specifically to instances where administrators enabled Require Email Confirmation to enforce identity verification before granting access to billing data.

Root Cause

The root cause is a mismatch between two authorization checks. The API middleware validates the email_approved flag before serving profile-adjacent endpoints. The page controller only checks that the requested path prefix matches /client, without validating the email verification status. Authorization logic diverges across layers, which qualifies as a CWE-863 Incorrect Authorization defect.

Attack Vector

An attacker registers a new client account using any email address they do not need to control. After logging in with the unverified session cookie, they issue standard HTTP GET requests to sensitive client-area URLs. The server renders the pages and returns real account data despite the missing email confirmation. No privilege escalation, exploit chain, or specialized tooling is required. See the GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-53642

Indicators of Compromise

Web server access logs showing requests to /client/balance, /client/order/list, or /client/invoice from accounts where email_approved = 0 in the database.
Client sessions that access billing pages without a preceding email confirmation event in the audit trail.
Multiple newly registered accounts accessing financial endpoints shortly after signup.

Detection Strategies

Query the FOSSBilling database to correlate access logs with the email_approved column and flag any client-area page view by an unverified user.
Deploy web application firewall rules that inspect session context and block /client/* page requests when the associated account lacks email verification.
Review historical logs for the period between installing an affected version and upgrading to 0.8.0 to identify prior exposure.

Monitoring Recommendations

Enable verbose HTTP request logging for all /client/* routes and forward logs to a centralized SIEM for correlation.
Alert on registration events followed within minutes by requests to /client/balance or /client/invoice.
Monitor for unusual read volume of transaction history endpoints tied to accounts created in the last 24 hours.

How to Mitigate CVE-2026-53642

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which contains the official fix.
Audit existing accounts for email_approved = 0 and review their access logs for accessed billing pages.
Force re-verification of any unverified accounts and invalidate active sessions belonging to them.

Patch Information

The maintainers released the fix in FOSSBilling version 0.8.0. The patch aligns the page-side authorization check with the API-side check, ensuring unverified clients are restricted to profile-related pages only. Refer to the GitHub Security Advisory GHSA-7v47-rh46-w923 for advisory details and upgrade guidance.

Workarounds

No official workarounds exist that avoid modifying the source code, according to the vendor advisory.
Operators unable to upgrade immediately can patch the page-side authorization logic to reject /client/* requests where email_approved = 0, except for profile endpoints.
Temporarily disable the Require Email Confirmation feature only if administrators can enforce verification through an alternative mechanism, since disabling it does not remediate the access control gap.

bash

# Configuration example - upgrade FOSSBilling to the patched release
git fetch --tags
git checkout v0.8.0
composer install --no-dev --optimize-autoloader
php bin/console migrate