CVE-2026-53643 Details

A vulnerability in FOSSBilling versions prior to 0.8.0 allows low-privileged staff accounts to perform unauthorized actions through admin API endpoints. This issue arises from the 'can_always_access' module flag, which grants all staff access to certain modules, combined with inadequate permission checks and unsafe parameter handling on specific endpoints. As a result, affected staff can access sensitive system settings, read decrypted extension configurations, expose environment details, manipulate system cron executions, manage global language packs, disrupt session management for administrators and clients, and interfere with password recovery processes.

Users can upgrade to FOSSBilling version 0.8.0, which addresses these vulnerabilities. Additionally, staff accounts should be restricted to those who need access to sensitive settings, and a reverse proxy or Web Application Firewall (WAF) can be used to limit access to the affected endpoints from trusted IP addresses or higher-privilege roles.