CVE-2026-111046

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111046
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111046.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111046
Aliases
  • GHSA-3g7m-ph2r-jhcx
Published
2026-10-19T15:49:48Z
Modified
2026-10-20T02:44:13Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions
Details

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage_settings checks. A low-privileged staff account with module-level extension access targets a deactivated non-core module through extension/config_get or extension/config_save. The account can call api/admin/extension/config_get or api/admin/extension/config_save for a deactivated non-core module to read decrypted retained extension secrets and overwrite stored extension configuration. The getConfig function returns the decrypted stored configuration despite the module's inactive state. This residual path remained after the earlier CVE-2026-62962 authorization fix. This issue is fixed in version 0.8.6.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111046.json"
}
References

Affected packages

Git / github.com/fossbilling/fossbilling

Affected ranges

Type
GIT
Repo
https://github.com/fossbilling/fossbilling
Events
Introduced
1db804d7402ad0497c17104386cacdd716f85ddc
Fixed
0da63688348768ac5ddbbe167a2b0c1403d1f92d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.8.4"
        },
        {
            "fixed":  "0.8.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.8.4
0.8.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111046.json"