FOSSBilling is a free, open‑source billing and client‑management system. Versions before 0.8.0 let a low‑privileged staff member, possessing only the staff.create_and_edit_staff permission, call the admin API endpoint /api/admin/staff/permissions_update on their own account to grant arbitrary module permissions to themselves, bypassing the intended role‑based access control and causing persistent privilege escalation. This improper authorization weakness (CWE‑269) allows an attacker to alter permissions permanently. Version 0.8.0 resolves the issue, and interim workarounds include restricting the staff.create_and_edit_staff permission to trusted users or limiting API access with a reverse proxy or WAF.

The vulnerability affects installations of FOSSBilling prior to version 0.8.0; all earlier releases are vulnerable and have been patched in version 0.8.0 and later.

The flaw carries a CVSS score of 8.5, indicating high severity. An EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the admin API and possession of the staff.create_and_edit_staff permission; without that privilege it cannot be leveraged. With that privilege, the attacker can gain comprehensive control over module permissions, enabling potential data theft, configuration changes, and lateral movement within the application.