CVE-2026-116257 Details
Description
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability allowing unauthenticated creation of administrator accounts has been identified in BillaBear versions prior to 2025.01.03. The issue resides in the Installation Handler component, specifically within the processInstall function of the InstallController.php file. This vulnerability arises from missing authentication, allowing remote exploitation. When the database schema has not been initialized, an attacker can execute the installation process, creating a confirmed administrator account with custom credentials.
To address this vulnerability, the '/install/process' endpoint should be guarded with an installed-state check to prevent access once the application has been set up. Alternatively, the installation process can be protected with a token supplied through an environment variable, or the installation route can be disabled entirely after completion.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/asdfghjkl12345678910111/d9fcbcdf74b3f07c427ade9fed927ad4 | [email protected] | ExploitRemedy |
| https://vuldb.com/cve/CVE-2026-116257 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1009909 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/426296 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/426296/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BillaBear | <= 2025.01.03 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |