Enigmaticious

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** A query-construction flaw in client list endpoints allows authenticated clients to bypass tenant scoping and retrieve data from other clients. The issue occurs in the `getSearchQuery()` functions of `ServiceTransaction` and `OrderService`, where OR-based search or action filters are appended without proper grouping. This allows SQL operator precedence to evaluate OR clauses independently of the enforced `client id` constraint. Consequently, crafted requests can return records and metadata belonging to other clients, such as identifiers, amounts, status, and timestamps. **Recommendations** Update to version 0.8.0.