CVE-2026-53644— FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| FOSSBilling | FOSSBilling | >= 0.5.3, < 0.8.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-53644
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders
Source: NVD (National Vulnerability Database)
Vulnerability Description
FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an `active` state (e.g., `suspended`, `canceled`). The root cause is missing order-state validation in two client API endpoints, despite an `isActive()` helper already existing in the `Serviceapikey` module and the frontend UI correctly gating access on `order.status == 'active'`. Version 0.8.0 contains a fix. Some workarounds are available. If the `Serviceapikey` module is not needed, uninstall it to remove the affected endpoints. One may also use a reverse proxy or WAF to restrict access to `/api/client/order/service` and `/api/client/serviceapikey/reset` based on application-level order-state logic.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| FOSSBilling | FOSSBilling | >= 0.5.3, < 0.8.0 | - |
II. Public POCs for CVE-2026-53644
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53644
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-53644 (1)
Same Patch Batch · FOSSBilling · 2026-07-06 · 17 CVEs total
| CVE-2026-42341 | FOSSBilling has an unauthenticated payment bypass via IPN callback forgery | |
| CVE-2026-42331 | FOSSBilling missing authorization in guest Invoice API endpoints | |
| CVE-2026-33734 | FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters | |
| CVE-2026-43921 | FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization | |
| CVE-2026-43918 | Suspended or inactive FOSSBilling accounts can retain or regain access through existing se | |
| CVE-2026-43927 | FOSSBilling has race condition in cart checkout that bypasses promo code usage limits | |
| CVE-2026-43925 | FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized | |
| CVE-2026-43928 | FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayme | |
| CVE-2026-53640 | FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive | |
| CVE-2026-53641 | FOSSBilling has stored XSS in client email views via unescaped content in JavaScript templ | |
| CVE-2026-53645 | FOSSBilling's missing self-edit prevention in staff permission management allows persisten | |
| CVE-2026-53646 | FOSSBilling: Client password reset token reuse allows persistent account takeover | |
| CVE-2026-53643 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin | |
| CVE-2026-53642 | FOSSBilling: Unverified clients can access client-area pages when email confirmation is re | |
| CVE-2026-53647 | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Servi | |
| CVE-2026-53648 | FOSSBilling: Downloadable product files can be overwritten through filename collisions |
IV. Related Vulnerabilities
Same product: FOSSBilling
- CVE-2026-53648
FOSSBilling: Downloadable product files can be overwritten t - CVE-2026-53647
FOSSBilling vulnerable to unauthenticated API key configurat - CVE-2026-53646
FOSSBilling: Client password reset token reuse allows persis - CVE-2026-53645
FOSSBilling's missing self-edit prevention in staff permissi - CVE-2026-53643
FOSSBilling allows low-privileged staff accounts to perform
Same vendor: FOSSBilling
- CVE-2026-53648
FOSSBilling: Downloadable product files can be overwritten t - CVE-2026-53647
FOSSBilling vulnerable to unauthenticated API key configurat - CVE-2026-53646
FOSSBilling: Client password reset token reuse allows persis - CVE-2026-53645
FOSSBilling's missing self-edit prevention in staff permissi - CVE-2026-53643
FOSSBilling allows low-privileged staff accounts to perform
Same weakness: CWE-639
- CVE-2026-15036
Harness gitspaces Endpoint list_all.go getAuthorizedSpaces a - CVE-2026-59253
n8n - Improper Authorization in Workflow Assignment to Folde - CVE-2026-5459
User Frontend: AI Powered Frontend Posting, User Directory, - CVE-2026-3688
WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insec - CVE-2026-55429
Coder's workspace app upsert allows cross-workspace agent re
V. Comments for CVE-2026-53644
No comments yet