CVE-2026-53645

The record

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has `staff.create_and_edit_staff` can call `/api/admin/staff/permissions_update` targeting their own account and write any permission structure, bypassing the intended role-based access control boundary. Version 0.8.0 patches the issue. Some workarounds are available. Restrict the `staff.create_and_edit_staff` permission to only highly trusted staff members and/or use a reverse proxy or WAF to restrict access to `/api/admin/staff/permissions_update` to specific trusted roles.

Affected packages

Related vulnerabilities

• CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
• CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
• CVE-2026-95837 containerd is an open-source container runtime. CWE-269
• CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
• CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269
• CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. CWE-269
• CVE-2026-74925 The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role… CWE-269
• CVE-2026-75777 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape… CWE-269