FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged `/api/system/*` endpoints. Because `system` resolves to the cron admin identity, attackers can invoke admin API methods without valid credentials, session, or CSRF token. Version 0.8.0 patches the issue. Some workarounds are available. Block external access to `/api/system/*` at reverse proxy/WAF, restrict API access by trusted source IPs only (`api.allowed_ips`), rotate all admin/client API tokens immediately, invalidate active sessions and reset high-privilege credentials, and/or review API request logs for suspicious `/api/system/` access and treat as potential incident.
The API role handling mechanism incorrectly resolves the `system` identity, assigning it administrator cron privileges without session verification, CSRF token, or credential validation. This means an unauthenticated attacker can directly invoke API methods reserved for administrators using `/api/system/*` endpoints. The vulnerability is classified as lack of authentication (CWE-306), lack of authorization (CWE-862, CWE-863), and information disclosure (CWE-200).
An attacker can perform arbitrary privileged administrative operations without any credentials, which may lead to complete system compromise, disclosure of customer data, and modification of configuration.
FOSSBilling should be updated to version 0.8.0, which contains the patch. Until updating, it is recommended to: block external access to `/api/system/*` at the reverse proxy or WAF level, restrict API access exclusively to trusted IP addresses (`api.allowed_ips`), immediately rotate all administrator and client API tokens, invalidate active sessions and reset authentication credentials for high-privilege accounts, and review API request logs for suspicious calls to `/api/system/`.
FOSSBilling in versions from 0.5.4 to earlier than 0.8.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X