CVE-2026-116257

BillaBear Installation InstallController.php processInstall missing authentication

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

Missing authentication in the processInstall route of BillaBear’s InstallController means that any caller can trigger the installation workflow without credentials. When invoked, the application will execute the full installation routine, which can alter configuration or complete setup. This results in unauthorized access to installation functionality and may allow an attacker to modify settings during the installation phase. The flaw is classified as Improper Authentication (CWE‑287) and Authentication Bypass (CWE‑306).

Affected Systems

BillaBear installations up to and including version 2025.01.03 are affected. Any deployment that contains the current InstallController::processInstall endpoint is vulnerable, regardless of the underlying operating system or hosting environment. As of the advisory, no vendor patch has been released for this issue.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium to high severity. The EPSS score is not available, so the precise probability of exploitation in the wild cannot be quantified. The advisory states that remote exploitation is possible, which implies that an unauthenticated attacker can target the installation endpoint over HTTP(S). The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported. Because the description does not detail the exact vector, the vulnerability is inferred to allow remote unauthenticated access, but the specific mechanisms remain unspecified.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a BillaBear release newer than 2025.01.03 when it becomes available
  • Restrict external access to the installation endpoint, for example by configuring firewall rules, IP allowlists, or an authentication wrapper
  • Disable or remove the InstallController::processInstall route in production until a patch is applied

Generated by OpenCVE AI on October 26, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title BillaBear Installation InstallController.php processInstall missing authentication
First Time appeared Billabear
Billabear billabear
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:billabear:billabear:*:*:*:*:*:*:*:*
Vendors & Products Billabear
Billabear billabear
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 31, 2026, 1:12 AM
Reserved
Oct 25, 2026, 5:30 PM

View source JSON

Updated
Oct 31, 2026, 1:12 AM

JSON

Status
Deferred
Published
Oct 26, 2026, 11:16 AM
Modified
Oct 31, 2026, 2:17 AM

View source JSON

No data.

Updated
Oct 26, 2026, 1:00 PM

JSON