CVE-2026-43925 Details
Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).
A mass assignment vulnerability has been identified in FOSSBilling versions 0.1.0 through 0.7.2, prior to the patch in version 0.8.0. This vulnerability allows unauthenticated users to assign themselves to any client group during the registration process via the public 'POST /api/guest/client/create' endpoint. The issue arises because the 'group_id' parameter is not properly validated or documented as an accepted input for guest registrations. As a result, attackers can exploit this vulnerability to gain access to group-specific discounts by applying promo codes restricted to certain client groups, such as staff or reseller discounts, immediately after registration.
Users can upgrade to FOSSBilling version 0.8.0 or later, where this vulnerability has been patched. Alternatively, administrators can remove group restrictions from promo codes or disable client self-registration in the settings.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-q4rq-9844-r9w2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |