Open Source Billing Platform Vulnerability in FOSSBilling by FOSSBilling
CVE-2026-111046
2.3LOW
What is CVE-2026-111046?
FOSSBilling, the open-source billing and client management platform, suffers from a vulnerability that allows low-privileged staff accounts to access sensitive configuration data. This issue arises due to a flaw in the hasManagePermission function, which fails to properly enforce access controls for inactive non-core modules. As a result, an attacker can exploit API calls to getConfig and config_save on deactivated modules, retrieving decrypted extension secrets and modifying the module configurations. This vulnerability has been addressed in version 0.8.6, underscoring the importance of regular updates to maintain security.
Affected Version(s)
FOSSBilling >= 0.8.4, < 0.8.6