FOSSBilling, an open‑source billing and client management system, allows low‑privileged staff accounts to read sensitive staff, client, and redirect information via admin API endpoints that lack permission checks. While sibling write endpoints correctly enforce fine‑grained permissions, the corresponding read endpoints have no authorization guards. As a result, any staff user with network access to the API can harvest confidential data, leading to a confidentiality breach (CWE‑200, CWE‑862). The vendor fix is included in version 0.8.0; workarounds include restricting staff roles or using a reverse proxy or WAF to block the affected endpoints.

The vulnerability affects all installations of FOSSBilling running a version prior to 0.8.0. FOSSBilling 0.8.0 and later versions include the vendor fix that restores proper permission enforcement on the read endpoints.

The CVSS score of 2.3 indicates a low overall severity, and the EPSS score of < 1 % demonstrates a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is internal; it requires an account with staff privileges, after which the attacker can read protected data without needing to bypass other controls. Because the read endpoints lack guard rails, any staff account with network access to the API can harvest the disclosed data.