CVE-2026-27604

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.4 through 0.7.x

Description An authorization bypass in the API role handling allows unauthenticated access to privileged '/api/system/*' endpoints. Because system resolves to the cron admin identity, attackers can invoke admin API methods without a valid session, credentials, or CSRF token.

Recommendations Update to version 0.8.0. Block external access to '/api/system/*' at the reverse proxy or Web Application Firewall (WAF). Restrict API access to trusted source IPs using the api.allowed ips setting. Rotate all admin and client API tokens immediately. Invalidate active sessions and reset high-privilege credentials. Review API request logs for suspicious '/api/system/' access.