CVE-2026-33543: FOSSBilling: Authentication bypass allows unauthenticated administrator creation

Synopsis

Authentication bypass in FOSSBilling (versions 0.7.2 and prior) allows any unauthenticated remote attacker to create a new administrator account through a guest API endpoint that was intended only for initial setup. A flawed guard check using is_countable() on a non-countable return type causes the admin-existence protection to always evaluate as true, leaving the /api/guest/staff/create endpoint permanently open. Successful exploitation gives the attacker a fully privileged admin session, enabling complete control over the billing and client management system. No fix version has been published upstream; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is served over HTTP/HTTPS, so the attacker must be able to reach the FOSSBilling service across a network.

• AuthenticationNot required

  The endpoint is a guest API route; no account, token, or credential of any kind is required to invoke it.

• Victim interactionNot required

  The attacker calls the endpoint directly; no action from an existing user or administrator is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the flawed is_countable() check always evaluates as true regardless of system state, so no race condition or special environment configuration is required.

Blast Radius

• The attacker creates a net-new administrator account with full privileges, bypassing every access control in the application.
• With an admin session, the attacker reads all stored customer records, invoices, payment details, and credentials managed by FOSSBilling.
• The attacker modifies or deletes billing records, client accounts, pricing configurations, and any data persisted by the system.
• The attacker can disrupt service availability by altering system settings or removing critical configuration, effectively taking the instance offline.