7Megaumka7

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** The Guest API 'invoice/update' endpoint lacks an authorization check. This allows an unauthenticated user who possesses an invoice hash to modify the payment gateway of an unpaid invoice by changing the `gateway id` variable to any payment gateway already configured in the system. Invoice hashes may be exposed through email links, referrer headers, or shared URLs. The impact is limited by the `invoice accessible from hash` system setting and the requirement that the gateway must be pre-installed by an administrator. **Recommendations** Update to version 0.8.0.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.5.6 through 0.7.2 **Description** When a `ClientPasswordReset` record already exists for a client from a previous unexpired request, subsequent calls to the `reset password` guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is based on the `created at` timestamp of the first request rather than the most recent email. This allows an attacker who obtained the original reset link to use it even after the victim requests a new reset, as the original token is not invalidated or rotated. **Recommendations** Update to version 0.8.0. Configure a reverse proxy to apply per-IP rate limiting to the `/client/reset-password` endpoint. Manually clear expired `client password reset` records from the database after a client reports a suspected compromise.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.5.3 through 0.7.2 **Description** The Guest `serviceapikey/get info` API endpoint is accessible without authentication. An attacker with a valid API key can retrieve all custom configuration parameters, specifically the `custom *` fields, stored in the database record associated with that key. These fields are managed by administrators and may contain sensitive business information, including pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. **Recommendations** Update to version 0.8.0. Avoid storing sensitive data in `custom *` API key configuration fields. Monitor API logs for suspicious calls to the `/api/guest/serviceapikey/get info` endpoint. Disable the Serviceapikey module if it is not in active use.