FOSSBilling is a free, open‑source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing authenticated sessions are not invalidated. The session identity loaders in src/di.php (loggedin_client and loggedin_admin) only reject sessions if the backing account record no longer exists in the database. They do not verify that the account’s status is still active. This allows a suspended or deactivated user to retain full access until their session naturally expires. The issue has been fixed in version 0.8.0. The weakness is classified as CWE‑613.

Only versions of FOSSBilling prior to 0.8.0 are vulnerable. The issue applies to client, staff, and admin accounts within those releases.

The vulnerability carries a CVSS score of 8.7, indicating high severity, while its EPSS score of less than 1% suggests that active exploitation is unlikely but still possible. Because the flaw permits an attacker who has captured or otherwise obtained a session token or API key to maintain access until the session expires, the impact can be substantial in terms of confidentiality, integrity, and availability. The vulnerability is not listed in CISA’s KEV catalog, but the potential for persistent abuse remains significant. The likely attack vector is the exploitation of an existing authenticated session or the compromise of API credentials.