FOSSBilling is a free, open‑source billing and client‑management system. Versions prior to 0.8.0 allow low‑privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the can_always_access module flag, which grants all staff broad access to certain modules, and insufficient permission checks or unsafe parameter handling on individual API endpoints. As a result, an attacker with minimal privileges can modify configuration settings, elevate privileges, and threaten system integrity or confidentiality. Version 0.8.0 contains a fix; temporary mitigations include restricting staff accounts to only those who need access to sensitive settings and/or using a reverse proxy or WAF to limit access from untrusted IPs or enforce role‑based restrictions.

The affected product is FOSSBilling, with all versions older than 0.8.0 susceptible. The flaw applies to every staff account regardless of its assigned role because the universal access flag overrides standard permission logic.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability, exposing significant confidentiality and integrity risks if exploited. The EPSS score of <1% indicates a very low but nonzero probability of exploitation; opportunistic attacks are unlikely but possible. The issue is not listed in the CISA KEV catalog, yet the low implementation barrier warrants proactive remediation.