Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge of an invoice hash to modify the payment gateway associated with an unpaid invoice. An attacker who obtains an invoice hash, which may leak through shared URLs, referrer headers, or email links, can change the `gateway_id` on an unpaid invoice to any payment gateway configured in the system. This does not allow redirecting payments to an arbitrary external endpoint, as the gateway must already be installed and configured by an administrator. The practical impact is further limited by the `invoice_accessible_from_hash` system setting. Version 0.8.0 contains a patch. No known workarounds are available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-04 | 1 | General1 |
| 2026-08-05 | 1 | General1 |
| 2026-08-07 | 1 | General1 |
| 2026-08-08 | 1 | Disclosure1 |
CVE-2026-42331 FOSSBilling バージョン0.8.0以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/03/cve-2026-42331-fossbilling-080/ #IT #Security #cybersecurity
Post summary
The post references CVE‑2026‑42331 affecting FOSSBilling <0.8.0 and promises a clear explanation of impact and countermeasures, but it provides no PoC, exploit code, or detailed technical information.
CVE-2026-42331 FOSSBilling バージョン0.8.0以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/03/cve-2026-42331-fossbilling-080/ #IT #Security #cybersecurity
Post summary
Article provides an overview of CVE‑2026‑42331 in FOSSBilling version 0.8.0 and earlier, summarizing impact and countermeasures, but contains no PoC, exploit, active exploitation claim, or patch details in the excerpt.
CVE-2026-42331 FOSSBilling バージョン0.8.0以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/03/cve-2026-42331-fossbilling-080/ #IT #Security #cybersecurity
Post summary
The article provides an overview of CVE‑2026‑42331 affecting FOSSBilling versions prior to 0.8.0 and summarizes the impact and general mitigation guidance.
CVE-2026-42331 FOSSBilling バージョン0.8.0以前の脆弱性をわかりやすく解説｜影響範囲と対策まとめ https://www.cybernote.click/2026/08/03/cve-2026-42331-fossbilling-080/ #IT #Security #cybersecurity
Post summary
The post announces CVE‑2026‑42331 affecting FOSSBilling versions before 0.8.0 and links to a Japanese article that explains the issue and summarizes impact and mitigation steps.