CVE-2026-33543 Details
Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already exists. The flawed guard check uses is_countable() on a value that returns a Model_Admin object or null rather than a countable type, causing the expression to always evaluate as true and bypass the intended protection. As a result, an attacker can reach the unprotected endpoint to create a new administrator account and immediately authenticate, gaining a fully privileged admin session even when an admin already exists. This issue has been fixed in version 0.8.0.
An authentication bypass vulnerability has been identified in FOSSBilling versions through 0.7.2. The issue resides in a guest API endpoint, /api/guest/staff/create, which is meant for initial administrator setup. Due to a flawed check that verifies the existence of an admin, the endpoint remains active even after an administrator has been created. This flaw allows an unauthenticated attacker to create a new administrator account, log in, and gain full access to the admin panel and admin API. The vulnerability arises because the existence check improperly uses is_countable() on a value that returns a Model_Admin object or null, rather than a countable type, leading to a false positive and bypassing the intended protection.
Users are advised to upgrade to FOSSBilling version 0.8.0, which addresses this vulnerability. After updating, review the release notes for potential breaking changes, especially if custom modules, themes, or API integrations are maintained.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0 | [email protected] | Release NotesVendor |
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-28mh-j262-q49w | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |