CVE-2026-111046 Details
Description
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with module-level extension access targets a deactivated non-core module through extension/config_get or extension/config_save. The account can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated non-core module to read decrypted retained extension secrets and overwrite stored extension configuration. The getConfig function returns the decrypted stored configuration despite the module's inactive state. This residual path remained after the earlier CVE-2026-62962 authorization fix. This issue is fixed in version 0.8.6.
A vulnerability exists in FOSSBilling versions 0.8.4 prior to 0.8.6, allowing low-privileged staff to access and modify the configuration of deactivated non-core extensions. The issue arises because the permission check in the 'hasManagePermission' function fails to account for inactive modules, inadvertently allowing unauthorized access to sensitive configuration data, such as decrypted extension secrets including API keys and payment gateway settings. This vulnerability was introduced after a previous authorization fix and is now addressed in version 0.8.6.
Users should upgrade to FOSSBilling version 0.8.6, where this vulnerability has been patched. Instructions for downloading the latest version are available on the FOSSBilling GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/commit/7a7a30984b58cd1008a573fc70296a7653d8ae04 | [email protected] | Source CodeVendor |
| https://github.com/FOSSBilling/FOSSBilling/pull/4184 | [email protected] | Issue TrackingVendor |
| https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.6 | [email protected] | Release NotesVendor |
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-3g7m-ph2r-jhcx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | >= 0.8.4, <= 0.8.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |