CVE-2026-42331: FOSSBilling missing authorization in guest Invoice API endpoints

Vulnerability summary

CVE-2026-42331 is a high (CVSS 7.7) vulnerability in fossbilling. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35% of scored vulnerabilities.

Timeline

1. 06-07-2026
   PublishedVulnerability first disclosed.
2. 07-07-2026
   Last modifiedVulnerability information updated.

Description

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Guest API invoice/update endpoint is missing an authorization check present in other invoice-related endpoints, allowing an unauthenticated user with knowledge of an invoice hash to modify the payment gateway associated with an unpaid invoice. An attacker who obtains an invoice hash, which may leak through shared URLs, referrer headers, or email links, can change the `gateway_id` on an unpaid invoice to any payment gateway configured in the system. This does not allow redirecting payments to an arbitrary external endpoint, as the gateway must already be installed and configured by an administrator. The practical impact is further limited by the `invoice_accessible_from_hash` system setting. Version 0.8.0 contains a patch. No known workarounds are available.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.