CVE-2026-111056
FOSSBilling is an open source billing and client-management platform.
Impact
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/FOSSBilling/FOSSBilling/commit/19f41ff0a45874c7362b7732c8f68db84bc59c55
- https://github.com/FOSSBilling/FOSSBilling/pull/4234
- https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7
- https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-x4mh-g4pc-wfc5