CVE-2026-53647: FOSSBilling Information Disclosure Flaw

CVE-2026-53647 Overview

CVE-2026-53647 is an information disclosure vulnerability in FOSSBilling, a free and open-source billing and client management system. The flaw affects versions 0.5.3 through 0.7.2 and resides in the Guest serviceapikey/get_info API endpoint. The endpoint is reachable without authentication, allowing any caller holding a valid API key to retrieve every custom_* configuration field stored in that key's database record. Administrators frequently populate these fields with business-sensitive data, including pricing tiers, feature flags, rate limits, expiry overrides, and access scope metadata. FOSSBilling 0.8.0 patches the issue. The vulnerability is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact

Unauthenticated attackers with knowledge of a valid API key can enumerate custom configuration fields containing business-sensitive commercial and operational data.

Affected Products

• FOSSBilling 0.5.3 through 0.7.2
• Serviceapikey module (/api/guest/serviceapikey/get_info endpoint)
• Fixed in FOSSBilling 0.8.0

Discovery Timeline

• 2026-07-07 - CVE-2026-53647 published to NVD
• 2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-53647

Vulnerability Analysis

The vulnerability exists in FOSSBilling's Serviceapikey module, which exposes the get_info action under the Guest API namespace. Guest endpoints in FOSSBilling are designed to be reachable without a session, and this endpoint returns the full record of the API key referenced in the request. The returned payload includes any custom_* fields that administrators have attached to that key. Because administrators use these fields to persist commercial parameters such as pricing tiers, feature toggles, per-client rate limits, expiry overrides, and access scope descriptors, disclosure directly leaks tenant configuration state.

Root Cause

The root cause is missing authentication and access control on a Guest-namespaced endpoint that returns records containing sensitive administrative metadata. The endpoint does not distinguish between fields intended for public consumption and internal configuration attributes prefixed with custom_*. Any actor able to present or enumerate a valid API key identifier receives the full record, including data never intended to leave the administrative boundary.

Attack Vector

Exploitation requires network access to the FOSSBilling instance and a valid API key value. An attacker issues an HTTP request to /api/guest/serviceapikey/get_info referencing the target key. The response returns the full key record, including the custom_* fields. No credentials, session cookies, CSRF tokens, or user interaction are required. The vulnerability carries an EPSS score of 0.42% at the 33.8 percentile, indicating limited observed exploit interest at the time of publication.

See the GitHub Security Advisory GHSA-737q-9gpr-6mpq for vendor technical details.

Detection Methods for CVE-2026-53647

Indicators of Compromise

• Requests to /api/guest/serviceapikey/get_info from external or unexpected source IP addresses.
• Repeated serviceapikey/get_info calls suggesting API key enumeration or scraping.
• Response payloads from the endpoint containing custom_* field names in outbound web server logs.

Detection Strategies

• Parse FOSSBilling web server access logs for the serviceapikey/get_info URI and correlate with client IP, user agent, and request frequency.
• Alert on high-volume access to the Guest API namespace, particularly from source networks outside partner or integration allowlists.
• Baseline legitimate integration traffic to /api/guest/serviceapikey/* and flag deviations in call rate or referrer.

Monitoring Recommendations

• Ship FOSSBilling application and web server logs to a centralized log analytics platform for retention and query.
• Build dashboards tracking Guest API endpoint call volume and unique caller IPs over rolling windows.
• Review outbound egress traffic from the FOSSBilling host for signs of automated harvesting of API responses.

How to Mitigate CVE-2026-53647

Immediate Actions Required

• Upgrade FOSSBilling to version 0.8.0 or later, which removes the unauthenticated exposure of custom_* fields.
• Rotate any API keys whose custom_* fields contained sensitive commercial or operational data.
• Audit historical API access logs for prior calls to /api/guest/serviceapikey/get_info to identify potential data exposure.

Patch Information

FOSSBilling 0.8.0 contains the fix for CVE-2026-53647. Refer to the FOSSBilling GHSA-737q-9gpr-6mpq advisory for release notes and upgrade guidance. Administrators should validate the upgrade in a staging environment before promoting to production.

Workarounds

• Avoid storing sensitive data such as pricing tiers, feature flags, rate limits, or access scopes in custom_* API key configuration fields.
• Monitor API logs for suspicious calls to /api/guest/serviceapikey/get_info and block offending source IPs at the perimeter.
• Disable the Serviceapikey module if it is not in active use within the deployment.

# Example: block the vulnerable endpoint at the reverse proxy (nginx)
location = /api/guest/serviceapikey/get_info {
    return 403;
}