FOSSBilling versions 0.8.4 through 0.8.6 contain a flaw where the hasManagePermission check is bypassed for inactive non‑core modules. A staff user with only module‑level access can target a deactivated module via the API endpoints extension/config_get or extension/config_save. The bug allows that user to read decrypted configuration data and overwrite stored settings for the inactive extension, exposing confidential secrets and allowing tampering with module behavior. This vulnerability represents a missing authorization condition and an elevation of privilege for users with limited rights.

The affected product is FOSSBilling (FOSSBilling). The vulnerability is present in releases 0.8.4, 0.8.5, and 0.8.6 and is fixed in version 0.8.6. Users deploying any of those releases should verify their install and plan an update if necessary.

The CVSS score is 2.3, indicating low overall severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation activity. The attack requires an account that already has module‑level access, so the risk is confined to internal staff who may have such permissions. Nonetheless, the exposure of decrypted secrets poses a confidential data risk and the ability to alter configuration could lead to improper module operation if abused.