CVE-2026-43920

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.4 through 0.7.2

Description The /run-patcher endpoint is accessible without authentication, allowing remote users to trigger privileged maintenance operations. These operations include configuration migrations, database schema changes (such as ALTER TABLE, DROP TABLE, and UPDATE statements), filesystem mutations (deletions and renames), and cache clearing. The endpoint lacks administrator authentication, CSRF validation, and CLI context requirements. An attacker can trigger these routines via an HTTP GET request to the /run-patcher endpoint, which may lead to denial-of-service attacks, session invalidation, or an inconsistent database state due to repeated or concurrent requests.