FOSSBilling - Information Disclosure (CVE-2026-27604)
Description
FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged /api/system/* endpoints. Because system resolves to the cron admin identity, attackers can invoke admin API methods without valid credentials, session, or CSRF token. Version 0.8.0 patches the issue. Some workarounds are available. Block external access to /api/system/* at reverse proxy/WAF, restrict API access by trusted source IPs only (api.allowed_ips), rotate all admin/client API tokens immediately, invalidate active sessions and reset high-privilege credentials, and/or review API request logs for suspicious /api/system/ access and treat as potential incident.
psychologyCrowdSec Analysis
CVE-2026-27604 is a critical authorization bypass in FOSSBilling versions 0.5.4 through 0.7.x that allows unauthenticated remote attackers to invoke privileged /api/system/* endpoints without credentials, a session, or a CSRF token. Exploitation can expose sensitive information and enable administrative actions that compromise the billing system’s confidentiality, integrity, and availability; version 0.8.0 fixes the issue.
CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-27604 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /api/system/system/error_reporting_enabled to probe FOSSBilling’s system API. The request may indicate an unauthenticated authorization bypass that exposes privileged system methods.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-06-23 |
| Rule Released | 2026-10-20 |
Related Weaknesses
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Remediation & Protection
External References
- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-78x5-c8gw-8279
- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc
- https://www.vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27604.yaml