CVE-2026-53645

Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.0

Description A low-privileged staff account can grant arbitrary module permissions to itself, leading to persistent privilege escalation. A user possessing the staff.create and edit staff permission can call the /api/admin/staff/permissions update endpoint targeting their own account to write any permission structure, which bypasses the role-based access control boundary.

Recommendations Update to version 0.8.0. Restrict the staff.create and edit staff permission to only highly trusted staff members. Use a reverse proxy or WAF to restrict access to the /api/admin/staff/permissions update endpoint to specific trusted roles.