FOSSBilling’s guest Invoice update API endpoint lacks an authorization check that is present in other invoice endpoints. An unauthenticated user who knows an invoice hash can alter the gateway_id field on an unpaid invoice. The weakness is a combination of missing authentication (CWE‑306) and missing authorization for modification (CWE‑863). The impact is limited to the gateway configured for that invoice and requires the target gateway to have been pre‑installed and configured by an administrator.

All releases of FOSSBilling before version 0.8.0 expose the guest invoice/update route that accepts requests containing an invoice hash. Administrators using these versions should verify that the invoice_accessible_from_hash setting is enabled and, if so, consider disabling it or applying the 0.8.0 patch.

The CVSS score of 7.7 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the API endpoint; an attacker can acquire an invoice hash through shared URLs, referrer headers, or email links. Once the hash is known, the attacker can change the gateway_id to any gateway configured in the system, potentially diverting payments or causing processing failures. The practical impact is bounded by the need for the gateway to already exist in the system, but the unintended gateway switch can still disrupt business operations. The invoice_accessible_from_hash system setting provides additional, though partial, mitigation.