A flaw in the Servicecustom Client API’s __call method allows an authenticated client to retrieve another client’s custom service data by supplying an order_id that is not validated for ownership. This IDOR vulnerability exposes personally identifying information—such as name, email, phone, address, company details, and VAT number—of other clients. No code execution or denial‑of‑service capability is described in the advisory, so the primary consequence is confidential data disclosure.

The vulnerability applies to FOSSBilling, the free, open‑source billing and client management system. Versions 0.7.2 and earlier contain the flaw; the issue is fixed in release 0.8.0. Any install that has not been upgraded beyond 0.7.2 is vulnerable.

The CVSS score of 7.1 indicates a high risk to confidentiality. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require only an authenticated client session; by guessing or enumerating sequential order IDs, an attacker can access data belonging to other clients. Because the flaw does not rely on special privileges or network exposure, exploitation is dependent on the ability to predict order numbers and on user session persistence.