CVE-2026-33543— FOSSBilling: Authentication bypass allows unauthenticated administrator creation

FOSSBilling: Authentication bypass allows unauthenticated administrator creation

FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains usable after an administrator already exists. The flawed guard check uses is_countable() on a value that returns a Model_Admin object or null rather than a countable type, causing the expression to always evaluate as true and bypass the intended protection. As a result, an attacker can reach the unprotected endpoint to create a new administrator account and immediately authenticate, gaining a fully privileged admin session even when an admin already exists. This issue has been fixed in version 0.8.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

使用候选路径或通道进行的认证绕过

FOSSBilling 授权问题漏洞

fossbilling是fossbilling团队开源的一种高效计费和客户管理方案。 FOSSBilling 0.7.2及之前版本存在授权问题漏洞，该漏洞源于管理员存在性检查缺陷，使用is_countable()函数对返回Model_Admin对象或null的值进行计数检查，导致表达式始终为真，允许攻击者通过/api/guest/staff/create端点创建新管理员账户并立即获得完全权限的管理员会话。

N/A

N/A