FOSSBilling versions prior to 0.8.0 expose a guest API endpoint intended for initial administrator setup. Due to a logic flaw in the admin‑existence check, the endpoint remains usable even when an administrator account already exists. The flawed guard uses a countable check on a value that returns a user object or null, resulting in a condition that is always true. This allows an unauthenticated user to create a new administrator account, immediately obtaining full administrative privileges. The impact is a complete loss of confidentiality, integrity, and availability for the billing system.

FOSSBilling, FOSSBilling v0.7.2 and earlier.

The vulnerability carries a CVSS score of 9.3 and is not listed in the CISA KEV catalog. Exploitation requires only access to the unauthenticated /api/guest/staff/create endpoint, which is typically reachable over HTTP/HTTPS. An attacker who can reach the endpoint can provide any desired credentials and will be logged in as a fully privileged administrator, without needing any existing credentials or additional privileges.