FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve all custom configuration parameters (`custom_*` fields) stored in the key's database record. These custom fields are populated by billing administrators and can contain business-sensitive data such as pricing tiers, feature flags, rate limits, expiry overrides, or access scope data. This vulnerability is related to CWE‑200 (Information Exposure), CWE‑306 (Missing Authentication), and CWE‑862 (Authorization Bypass Through User‑Controlled Key). Version 0.8.0 patches the issue. Some workarounds are available.

The issue affects FOSSBilling versions 0.5.3 through 0.7.2. The vulnerable product is the FOSSBilling billing and client management system. All installations of these versions that use the Serviceapikey module are potentially impacted.

The CVSS score of 6.9 indicates a moderate‑to‑high risk. The EPSS score of <1% indicates a very low probability of exploitation. It is not listed in CISA KEV. An attacker requires a valid API key; with it, the unauthenticated endpoint can disclose sensitive configuration. Version 0.8.0 resolves the vulnerability.