Auth bypass in Fossbilling
CVE-2026-42331
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticate…
Vulnerability class: Broken Authentication
Affected products
- Fossbilling — versions < 0.8.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)