FOSSBilling, an open‑source billing and client management system, allows authenticated clients in versions 0.5.3 through 0.7.2 to read and reset API key service secrets for orders that are no longer in an 'active' state, such as suspended or canceled. The root cause is missing order‑state validation in two client API endpoints, even though an isActive() helper exists in the Serviceapikey module and the frontend UI correctly gates access on order.status == 'active'. Version 0.8.0 contains a fix, and workarounds include uninstalling the Serviceapikey module or restricting access to /api/client/order/service and /api/client/serviceapikey/reset with a reverse proxy or WAF.

FOSSBilling versions 0.5.3 through 0.7.2 are affected. The product is the open‑source billing and client management system FOSSBilling. Version 0.8.0 and later contain the fix.

The CVSS score of 8.6 ranks this flaw as high, and it is not listed in the CISA KEV catalog. The EPSS score is less than 1%, indicating a low exploitation probability. The lack of state checks means an attacker only needs to be a legitimate client of an order that has moved from active to another state. Once authenticated, the attacker can read or reset the key, enabling further unauthorized API calls. Based on the description, it is inferred that the attack vector is remote via the exposed API endpoints, and does not require local access.