CVE-2026-53647 Details
Description
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. Version 0.8.0 patches the issue. Some workarounds are available. Administrators can avoid storing sensitive data in `custom_*` API key configuration fields, monitor API logs for suspicious calls to `/api/guest/serviceapikey/get_info`, and/or disable the Serviceapikey module if not in active use.
A vulnerability exists in FOSSBilling versions 0.5.3 prior to 0.7.2, allowing unauthenticated access to the Guest 'serviceapikey/get_info' API endpoint. This endpoint can be accessed by any caller with a valid API key, enabling them to retrieve all custom configuration parameters ('custom_*' fields) associated with that key. These fields, populated by billing administrators, may contain sensitive business data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope information. The vulnerability arises because the endpoint lacks authentication and authorization checks, allowing unauthorized access to internal administrative data that should not be visible to customers.
Users can upgrade to FOSSBilling version 0.8.0, where this vulnerability is patched. Additionally, administrators can avoid storing sensitive information in 'custom_*' API key fields, monitor API logs for unusual activity related to the 'serviceapikey/get_info' endpoint, and disable the Serviceapikey module if it is not actively being used.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-737q-9gpr-6mpq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FOSSBilling | >= 0.5.3, <= 0.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |