CVE-2026-111046 FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
Low-privileged staff can read and modify configuration of deactivated extensions in FOSSBilling due to a permission check bypass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111046?
CVE-2026-111046 is a low-severity missing authorization vulnerability in FOSSBilling, published on 19 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with module-level extension access targets a deactivated non-core module through extension/config_get or extension/config_save. The account can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated non-core module to read decrypted retained extension secrets and overwrite stored extension configuration. The getConfig function returns the decrypted stored configuration despite the module's inactive state. This residual path remained after the earlier CVE-2026-62962 authorization fix. This issue is fixed in version 0.8.6.
Which versions are affected by CVE-2026-111046?
How do I fix CVE-2026-111046?
No fix has been published for CVE-2026-111046 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111046 being exploited?
There is no known exploitation of CVE-2026-111046 in the wild and no public exploit code.
Sources
Also known as GHSA-3g7m-ph2r-jhcx.