FOSSBilling, suffers from missing authentication and authorization in the guest invoice/update API. An unauthenticated user who knows or can guess an invoice hash can change the gateway_id field on any unpaid invoice. The vulnerability is an instance of CWE‑306 (Missing Authentication) and CWE‑863 (Missing Authorization for Modification). The attacker to billing the new gateway is misconfigured or malicious.

All releases of FOSSBilling before version 0.8.0 invoice/update route that accepts requests containing an invoice hash. Administrators should verify which of their deployed versions are impacted and apply the patch released in 0.8.0.

The CVSS score of 7.7 indicates high severity while the EPSS score of < 1% suggests a very low probability of exploitation. The likely attack vector is API, inferred from the description. An attacker may obtain an invoice hash through shared URLs, referrer headers, or email links. The impact is bounded by the requirement that the target gateway be pre‑installed, but the unintended gateway switch can still disrupt payment processing or enable unauthorized transaction routing. The vulnerability is not listed in the CISA KEV catalog and is mitigated by disabling the invoice_accessible_from_hash setting if it is not required.