# CVE-2026-27604: FOSSBilling - Information Disclosure

> Live exploitation tracking for CVE-2026-27604 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-27604

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** FOSSBilling
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor); CWE-306 (Missing Authentication for Critical Function); CWE-862 (Missing Authorization); CWE-863 (Incorrect Authorization)
- **Tags:** ecommerce, web_application

## Description

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged `/api/system/*` endpoints. Because `system` resolves to the cron admin identity, attackers can invoke admin API methods without valid credentials, session, or CSRF token. Version 0.8.0 patches the issue. Some workarounds are available. Block external access to `/api/system/*` at reverse proxy/WAF, restrict API access by trusted source IPs only (`api.allowed_ips`), rotate all admin/client API tokens immediately, invalidate active sessions and reset high-privilege credentials, and/or review API request logs for suspicious `/api/system/` access and treat as potential incident.

## CrowdSec analysis

[CVE-2026-27604](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-27604) is a critical authorization bypass in FOSSBilling versions 0.5.4 through 0.7.x that allows unauthenticated remote attackers to invoke privileged `/api/system/*` endpoints without credentials, a session, or a CSRF token. Exploitation can expose sensitive information and enable administrative actions that compromise the billing system’s confidentiality, integrity, and availability; version 0.8.0 fixes the issue.

CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-27604 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target `/api/system/system/error_reporting_enabled` to probe FOSSBilling’s system API. The request may indicate an unauthenticated authorization bypass that exposes privileged system methods.

## Timeline

- 2026-06-23: CVE Published. CVE-2026-27604 is published to NVD.
- 2026-10-20: Rule Released. CrowdSec releases a rule to detect CVE-2026-27604 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-78x5-c8gw-8279
- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-57mv-jm88-66jc
- https://www.vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-27604.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-27604) follows observed exploitation activity for CVE-2026-27604. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.