CVE-2026-111056 Details

A vulnerability exists in FOSSBilling versions 0.1.0 prior to 0.8.7, allowing for email enumeration through the unauthenticated POST /api/guest/client/create endpoint. When an email is already registered, the response includes a specific error message, indicating the email's existence in the system. This issue arises because the API directly exposes exception messages without redaction, creating a clear path for attackers to verify registered emails. The vulnerability can be exploited by sending requests to the guest signup endpoint with different email addresses and observing the responses. This enumeration can be done manually or automated, and the application has no means to detect or prevent such checks.

Users should update to FOSSBilling version 0.8.7 or later, where this vulnerability has been fixed. If immediate updating is not possible, consider disabling public signups or adding stricter rate limits on the guest signup endpoint.