CVE-2026-111056

CVE-2026-111056 · FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.

CVSS 6.9 · Media · EPSS 0,3%

Publicación

2026-10-19T16:00:57.576Z

Actualización

2026-10-22T03:02:43.261Z

Comprueba tu servidor →