Missing authentication in the processInstall route of BillaBear’s InstallController means that any caller can trigger the installation workflow without credentials. When invoked, the application will execute the full installation routine, which can alter configuration or complete setup. This results in unauthorized access to installation functionality and may allow an attacker to modify settings during the installation phase. The flaw is classified as Improper Authentication (CWE‑287) and Authentication Bypass (CWE‑306).

BillaBear installations up to and including version 2025.01.03 are affected. Any deployment that contains the current InstallController::processInstall endpoint is vulnerable, regardless of the underlying operating system or hosting environment. As of the advisory, no vendor patch has been released for this issue.

The CVSS score of 6.9 indicates a medium to high severity. The EPSS score is not available, so the precise probability of exploitation in the wild cannot be quantified. The advisory states that remote exploitation is possible, which implies that an unauthenticated attacker can target the installation endpoint over HTTP(S). The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation has been reported. Because the description does not detail the exact vector, the vulnerability is inferred to allow remote unauthenticated access, but the specific mechanisms remain unspecified.