CVE-2026-23513

Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.0

Description A query-construction flaw in client list endpoints allows authenticated clients to bypass tenant scoping and retrieve data from other clients. The issue occurs in the getSearchQuery() functions of ServiceTransaction and OrderService, where OR-based search or action filters are appended without proper grouping. This allows SQL operator precedence to evaluate OR clauses independently of the enforced client id constraint. Consequently, crafted requests can return records and metadata belonging to other clients, such as identifiers, amounts, status, and timestamps.

Recommendations Update to version 0.8.0.