CVE WatchJul 7, 2026

CVE-2026-53644

FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both re

CVSS

—

No CVSS

EPSS

0.3%

p17

KEV

—

Exploit Today

0-100

Published: Jul 6, 2026 · Last modified: Jul 7, 2026 · CWE-639

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-07-072026-07-20

Technical description

FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an `active` state (e.g., `suspended`, `canceled`). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper already existing in the `Serviceapikey` module and the frontend UI correctly gating access on `order.status == 'active'`. Version 0.8.0 contains a fix. Some workarounds are available. If the `Serviceapikey` module is not needed, uninstall it to remove the affected endpoints. One may also use a reverse proxy or WAF to restrict access to `/api/client/order/service` and `/api/client/serviceapikey/reset` based on application-level order-state logic.

Official references

github.comhttps://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-qf6j-vq68-qmfh

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-552558.4 HIG

42.9%

KEV—63Langflow Authorization Bypass Through User-Controlled Key Vulnerability12d CVE-2021-464168.1 HIG

89.9%

——27Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.7d CVE-2022-289867.5 HIG

80.9%

——24LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.12d CVE-2020-234465.3 MED

65.5%

——20Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API12d CVE-2021-33806.5 MED

61.6%

——18Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.12d CVE-2022-362029.8 CRI

51.6%

——15Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (IDOR) via id= parameter.12d