CVE-2026-42331

Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.0

Description The Guest API 'invoice/update' endpoint lacks an authorization check. This allows an unauthenticated user who possesses an invoice hash to modify the payment gateway of an unpaid invoice by changing the gateway id variable to any payment gateway already configured in the system. Invoice hashes may be exposed through email links, referrer headers, or shared URLs. The impact is limited by the invoice accessible from hash system setting and the requirement that the gateway must be pre-installed by an administrator.

Recommendations Update to version 0.8.0.