CVE-2026-53645 Details

A vulnerability in FOSSBilling versions prior to 0.8.0 allows low-privileged staff accounts to escalate privileges by granting themselves arbitrary module permissions through the admin API. Staff users with the 'staff.create_and_edit_staff' permission can manipulate their own permission sets, bypassing the intended role-based access controls. This flaw leads to persistent privilege escalation, as the new permissions are saved in the database and remain effective across sessions. The vulnerability arises from a lack of self-edit prevention and proper oversight of permission modifications, particularly in the 'permissions_update' endpoint.

Users are advised to update to FOSSBilling version 0.8.0 or later. As a temporary measure, the 'staff.create_and_edit_staff' permission should be restricted to highly trusted staff members. Alternatively, a reverse proxy or Web Application Firewall (WAF) can be used to limit access to the 'permissions_update' endpoint, allowing only specific trusted roles to make changes.