CVE-2026-53647

Name of the Vulnerable Software and Affected Versions FOSSBilling versions 0.5.3 through 0.7.2

Description The Guest serviceapikey/get info API endpoint is accessible without authentication. An attacker with a valid API key can retrieve all custom configuration parameters, specifically the custom * fields, stored in the database record associated with that key. These fields are managed by administrators and may contain sensitive business information, including pricing tiers, feature flags, rate limits, expiry overrides, or access scope data.

Recommendations Update to version 0.8.0. Avoid storing sensitive data in custom * API key configuration fields. Monitor API logs for suspicious calls to the /api/guest/serviceapikey/get info endpoint. Disable the Serviceapikey module if it is not in active use.