CVE-2026-27604: FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

Synopsis

An authorization bypass vulnerability in FOSSBilling allows unauthenticated remote attackers to call privileged admin API endpoints under the `/api/system/*` path. Because the `system` role incorrectly resolves to the cron admin identity, no credentials, session, or CSRF token are needed to invoke admin-level API methods. Successful exploitation gives an attacker full administrative control over the billing system, including the ability to read, modify, and potentially destroy all managed data. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoints are exposed over the network, so an attacker must be able to reach the FOSSBilling service via HTTP/HTTPS.

• AuthenticationNot required

  No credentials, session token, or CSRF token are required; the authorization bypass allows unauthenticated callers to invoke admin API methods directly.

• Victim interactionNot required

  The attacker sends crafted API requests directly to the server; no action from a logged-in user or administrator is needed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race windows, or knowledge of memory layout.

Blast Radius

• Reads all billing records, client personal data, stored API tokens, and admin credentials held by the FOSSBilling instance.
• Modifies or deletes invoices, client accounts, subscription records, and system configuration through unrestricted admin API calls.
• Crashes or destabilizes the billing service by invoking destructive admin operations without restriction.
• Compromises downstream systems and integrations by harvesting and reusing rotated admin and client API tokens obtained through the bypass.