CVE-2026-53647: FOSSBilling Information Disclosure Flaw

CVE-2026-53647 Overview

CVE-2026-53647 is an information disclosure vulnerability in FOSSBilling, a free and open-source billing and client management system. The flaw affects versions 0.5.3 through 0.7.2 and resides in the Guest serviceapikey/get_info API endpoint. The endpoint is reachable without authentication, allowing any caller holding a valid API key to retrieve every custom_* configuration field stored in that key's database record. Administrators frequently populate these fields with business-sensitive data, including pricing tiers, feature flags, rate limits, expiry overrides, and access scope metadata. FOSSBilling 0.8.0 patches the issue. The vulnerability is categorized under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated attackers with knowledge of a valid API key can enumerate custom configuration fields containing business-sensitive commercial and operational data.

Affected Products

FOSSBilling 0.5.3 through 0.7.2
Serviceapikey module (/api/guest/serviceapikey/get_info endpoint)
Fixed in FOSSBilling 0.8.0

Discovery Timeline

2026-07-07 - CVE-2026-53647 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-53647

Vulnerability Analysis

The vulnerability exists in FOSSBilling's Serviceapikey module, which exposes the get_info action under the Guest API namespace. Guest endpoints in FOSSBilling are designed to be reachable without a session, and this endpoint returns the full record of the API key referenced in the request. The returned payload includes any custom_* fields that administrators have attached to that key. Because administrators use these fields to persist commercial parameters such as pricing tiers, feature toggles, per-client rate limits, expiry overrides, and access scope descriptors, disclosure directly leaks tenant configuration state.

Root Cause

The root cause is missing authentication and access control on a Guest-namespaced endpoint that returns records containing sensitive administrative metadata. The endpoint does not distinguish between fields intended for public consumption and internal configuration attributes prefixed with custom_*. Any actor able to present or enumerate a valid API key identifier receives the full record, including data never intended to leave the administrative boundary.

Attack Vector

Exploitation requires network access to the FOSSBilling instance and a valid API key value. An attacker issues an HTTP request to /api/guest/serviceapikey/get_info referencing the target key. The response returns the full key record, including the custom_* fields. No credentials, session cookies, CSRF tokens, or user interaction are required. The vulnerability carries an EPSS score of 0.42% at the 33.8 percentile, indicating limited observed exploit interest at the time of publication.

See the GitHub Security Advisory GHSA-737q-9gpr-6mpq for vendor technical details.

Detection Methods for CVE-2026-53647

Indicators of Compromise

Requests to /api/guest/serviceapikey/get_info from external or unexpected source IP addresses.
Repeated serviceapikey/get_info calls suggesting API key enumeration or scraping.
Response payloads from the endpoint containing custom_* field names in outbound web server logs.

Detection Strategies

Parse FOSSBilling web server access logs for the serviceapikey/get_info URI and correlate with client IP, user agent, and request frequency.
Alert on high-volume access to the Guest API namespace, particularly from source networks outside partner or integration allowlists.
Baseline legitimate integration traffic to /api/guest/serviceapikey/* and flag deviations in call rate or referrer.

Monitoring Recommendations

Ship FOSSBilling application and web server logs to a centralized log analytics platform for retention and query.
Build dashboards tracking Guest API endpoint call volume and unique caller IPs over rolling windows.
Review outbound egress traffic from the FOSSBilling host for signs of automated harvesting of API responses.

How to Mitigate CVE-2026-53647

Immediate Actions Required

Upgrade FOSSBilling to version 0.8.0 or later, which removes the unauthenticated exposure of custom_* fields.
Rotate any API keys whose custom_* fields contained sensitive commercial or operational data.
Audit historical API access logs for prior calls to /api/guest/serviceapikey/get_info to identify potential data exposure.

Patch Information

FOSSBilling 0.8.0 contains the fix for CVE-2026-53647. Refer to the FOSSBilling GHSA-737q-9gpr-6mpq advisory for release notes and upgrade guidance. Administrators should validate the upgrade in a staging environment before promoting to production.

Workarounds

Avoid storing sensitive data such as pricing tiers, feature flags, rate limits, or access scopes in custom_* API key configuration fields.
Monitor API logs for suspicious calls to /api/guest/serviceapikey/get_info and block offending source IPs at the perimeter.
Disable the Serviceapikey module if it is not in active use within the deployment.

bash

# Example: block the vulnerable endpoint at the reverse proxy (nginx)
location = /api/guest/serviceapikey/get_info {
    return 403;
}