CVE-2026-111056

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.1.0 through 0.8.6

Description The unauthenticated endpoint "/api/guest/client/create" reveals whether a submitted email belongs to a registered client. This occurs because the guest signup process returns a distinct, unredacted error message when the submitted email already exists in the system. The issue is triggered by an unauthenticated request to the "/api/guest/client/create" endpoint with a target email address. Technically, the function BoxModClientApiGuest::create returns an error after ClientService::clientAlreadyExists finds a matching record, and the API response exposes this exception message without redaction.

Recommendations Update to version 0.8.7.