CVE-2026-27604Disclosure

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged `/api/system/*` endpoints. Because `system` resolves to the cron admin identity, attackers can invoke admin API methods without valid credentials, session, or CSRF token. Version 0.8.0 patches the issue. Some workarounds are available. Block external access to `/api/system/*` at reverse proxy/WAF, restrict API access by trusted source IPs only (`api.allowed_ips`), rotate all admin/client API tokens immediately, invalidate active sessions and reset high-privilege credentials, and/or review API request logs for suspicious `/api/system/` access and treat as potential incident.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-200CWE-306CWE-862CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://secalerts.co/vulnerability/CVE-2026-27604?utm_campaign=x

Full discourse1 post

SecAlerts@SecAlertsCo92d
Disclosure
🧾 CVE-2026-27604: FOSSBilling has a CVSS 10 auth bypass letting unauthenticated users hit privileged admin API functions. Affects v0.5.4 through pre-0.8.0. Upgrade now. #infosec #cybersecurity https://secalerts.co/vulnerability/CVE-2026-27604?utm_campaign=x https://t.co/BhrtWHezIr
Post summary
The note highlights a severe authentication bypass in FOSSBilling, providing technical details and urging an upgrade, but makes no claim of current exploitation or a PoC.
0001098
842 followersView on X

Explore more

Back to dashboard