CVE-2026-53645
FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has staff.create_and_edit_staff can call /api/admin/staff/permissions_update targeting their own account and write any permission structure, bypassing the intended role-based access control boundary.
Version 0.8.0 patches the issue. Some workarounds are available. Restrict the staff.create_and_edit_staff permission to only highly trusted staff members and/or use a reverse proxy or WAF to restrict access to /api/admin/staff/permissions_update to specific trusted roles.
- ⚠ NVD has not scored this CVE yet - manual triage required (common for recent CVEs)
Severity & exploitation scoring
AV:_/AC:_/... vector string published by NVD.ATT&CK techniques
1Techniques this CVE enables. Pills with a solid outline are high confidence - named directly in ATT&CK or Nuclei, or human-curated by CTID; the rest are inferred from the weakness type using MITRE's CVE Mapping Methodology and the CWE → CAPEC chain. Broad, generic-weakness guesses are filtered out. A small N× marks a technique that N independent sources agree on.
▤ Build a SIEM detection for these techniquesCAPEC attack patterns
3Attack patterns this CVE enables - the bridge from weakness to ATT&CK technique.