FOSSBilling is a free, open‑source billing and client management system. Until version 0.8.0, a race condition in the cart checkout flow allowed an authenticated client to apply a promo code beyond its configured maximum uses. By sending concurrent checkout requests before the usage counter is incremented, a client can obtain unlimited discounted or free orders from a single‑use or limited‑use promo code. The issue is fixed in 0.8.0. Workarounds include disabling promo codes until a patch is applied or monitoring the promo table for used values that exceed maxuses and manually reviewing affected orders.

The vulnerability affects the FOSSBilling billing and client management platform. All installations running any version earlier than 0.8.0 are susceptible. The flaw is confined to the cart checkout routine where promo codes are validated and incremented.

The CVSS score of 6.9 indicates a moderate severity. Because the flaw requires an authenticated user account and the ability to issue simultaneous checkout requests, it is not trivial for an unauthenticated attacker but is practical for legitimate clients who wish to abuse the promo system. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog, but the direct monetary impact to a merchant can be substantial. Patching is the only proven method to eliminate the risk; until then, disabling promo codes or closely monitoring usage logs mitigates the potential abuse.