FOSSBilling versions 0.5.4 through 0.7.2 expose a /run-patcher maintenance endpoint that can be accessed without authentication or CSRF protection. An attacker can send a simple HTTP GET request to trigger privileged update procedures, resulting in configuration file changes, database schema modifications (including ALTER TABLE, DROP TABLE, UPDATE commands), filesystem deletions or renames, and cache clearing. These actions can disrupt service availability, compromise database consistency, and erase or alter critical configuration data. The vulnerability represents a moderate-impact flaw that allows unauthenticated users to perform arbitrarily destructive changes.

The affected product is FOSSBilling, a free, open-source billing and client management system. Vulnerable versions range from 0.5.4 up to and including 0.7.2. The issue was fixed in release 0.8.0.

The CVSS score of 6.9 indicates moderate severity. While the EPSS score is not provided, the lack of authentication and the direct exposure of a privileged endpoint make exploitation highly likely if the system is reachable from the internet. The vulnerability is not listed in the CISA KEV catalog, but the potential for widespread damage and lack of safeguards warrant prompt attention. Attackers can simply make an unauthenticated request over HTTP, so the attack vector is remote network access.