CVE-2026-53644 FOSSBilling CVE debrief

Who should care

Users of FOSSBilling, especially those with active installations, should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 0.8.0 or applying workarounds such as uninstalling the Serviceapikey module or using a reverse proxy to restrict access to affected endpoints. Operators, platform administrators, and security teams should review the vulnerability and implement necessary controls.

Technical summary

The vulnerability exists in FOSSBilling versions 0.5.3 through 0.7.2. Authenticated clients can exploit this vulnerability to read and reset API key service secrets for inactive orders. The root cause is the lack of order-state validation in two client API endpoints. An 'isActive()' helper function already exists in the Serviceapikey module, and the frontend UI correctly restricts access based on order status. Users should upgrade to version 0.8.0 or apply workarounds.

Defensive priority

High

Recommended defensive actions

• Upgrade to FOSSBilling version 0.8.0 or later
• Uninstall the Serviceapikey module if not needed
• Use a reverse proxy or WAF to restrict access to /api/client/order/service and /api/client/serviceapikey/reset based on application-level order-state logic
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-06T23:16:56.360Z and last modified on 2026-07-07T14:16:32.743Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected FOSSBilling deployments and review official advisories.

Official resources