The vulnerability allows an unauthenticated user to probe the /api/guest/client/create endpoint of FOSSBilling. By sending a POST request with a target email address, the API responds with distinct, unredacted error messages that reveal whether the email already belongs to a registered client. This exposure enables attackers to enumerate existing client accounts and obtain a list of registered email addresses, facilitating targeted phishing or further compromise. The flaw is a classic information‑disclosure weakness (CWE‑200), coupled with indication‑based enumeration (CWE‑204) and a lack of authentication enforcement for a signup endpoint (CWE‑307).

The flaw affects all installations of FOSSBilling from version 0.1.0 up to and including 0.8.7. Vendors and users should verify their platform version; the issue is fixed in release 0.8.7 and later.

The CVSS score of 6.9 indicates a medium‑severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that publicly known exploitation is not reported. Attackers only need the ability to send unauthenticated HTTP requests to the public API, making the exploit straightforward to execute. Because the API endpoint is reachable without any special privileges, the likelihood of successful exploitation is reasonably high for systems exposed to the internet. An attacker can simply send repeated requests to build an inventory of client accounts before moving on to social‑engineering or other attacks.