FOSSBilling up to 0.7.x Serviceapikey get_info information disclosure

Summaryinfo

A vulnerability was found in FOSSBilling up to 0.7.x and classified as problematic. This affects an unknown part of the file /api/guest/serviceapikey/get_info of the component Serviceapikey Module. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-53647. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in FOSSBilling up to 0.7.x. It has been declared as problematic. This vulnerability affects an unknown code of the file /api/guest/serviceapikey/get_info of the component Serviceapikey Module. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. Version 0.8.0 patches the issue. Some workarounds are available. Administrators can avoid storing sensitive data in `custom_*` API key configuration fields, monitor API logs for suspicious calls to `/api/guest/serviceapikey/get_info`, and/or disable the Serviceapikey module if not in active use.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-53647 since 06/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 0.8.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-41973). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Billing Software

Name

• FOSSBilling

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7

Website

• Product: https://github.com/FOSSBilling/FOSSBilling/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion