CVE-2026-43928 Details
Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks and credits the IPN-supplied amount (`mc_gross`) to the client's balance without validating it against the invoice total. Combined with a $0.05 floating-point epsilon tolerance in the invoice credit-payment logic, this allows a client to underpay an invoice by up to $0.04 and still have it marked as fully paid. Version 0.8.0 patches the issue. There is no effective workaround without modifying the source code. Merchants using the PayPalEmail adapter should monitor IPN transactions for amounts that do not match their corresponding invoice totals, and manually review and refund suspicious payments.
A vulnerability exists in the FOSSBilling PayPalEmail payment adapter prior to version 0.8.0, where incoming PayPal IPN callbacks are credited to the client's balance without verifying the amount against the invoice total. This flaw, combined with a $0.05 tolerance in the payment processing logic, enables clients to underpay invoices by up to $0.04 while still having them marked as fully paid. Merchants using this adapter should review IPN transactions for discrepancies and manually address suspicious payments.
Users can update to FOSSBilling version 0.8.0 or later, where this vulnerability has been patched. For those unable to update, it is recommended to monitor PayPal IPN transactions for underpayments and manually review and refund any suspicious amounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-xjc6-g382-h942 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-xjc6-g382-h942 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |