Email Exposure Vulnerability in FOSSBilling by FOSSBilling Team
CVE-2026-111056

6.9MEDIUM

Key Information:

Vendor

Fossbilling

Status
Fossbilling
Vendor
CVE Published:
19 October 2026

What is CVE-2026-111056?

The FOSSBilling platform has a vulnerability where the unauthenticated POST request to the /api/guest/client/create endpoint discloses information about registered email accounts. When a user attempts to sign up with an email that already exists in the system, the API responds with an unredacted error message confirming the existence of that email. This allows potential attackers to enumerate client emails, posing a significant threat to user privacy. Notably, this issue was resolved in version 0.8.7, where the error messages were properly redacted to enhance security.

Affected Version(s)

FOSSBilling >= 0.1.0, < 0.8.7

References

https://github.com/FOSSBilling/FOSSBilling/security/advis...
x_refsource_CONFIRM
https://github.com/FOSSBilling/FOSSBilling/pull/4234
x_refsource_MISC
https://github.com/FOSSBilling/FOSSBilling/commit/19f41ff...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.