FOSSBilling is a free and open-source billing and client management platform designed primarily for web hosting businesses. It helps automate various hosting business related operations including customer management, invoicing, payment processing, hosting account provisioning. The platform integrates with popular hosting control panels such as cPanel, Plesk and DirectAdmin which allows the hosting providers to automatically create and manage hosting accounts based on the products and plans purchased by their customers.
FOSSBilling is still in its beta phase and under active development. However, it is already used by businesses for billing and service management. Many developers also use it as a foundation for building customized billing solutions tailored to their needs. The project has gained significant attention from the open-source community, with approximately 1.7K GitHub stars and over 120 contributors.
The Vulnerability
During my security research, I discovered a mass assignment vulnerability in FOSSBilling affecting versions from 0.1.0 through 0.8.5.
The vulnerability allows a normal client to override the administrator-configured hosting plan when ordering a hosting product. The vulnerability allows an attacker to purchase a cheap hosting product while specifying the hosting_plan_id of a higher-tier plan and get higher-tier hosting resources without paying the premium price.
The issue exists in the hosting service ordering process, specifically in the attachOrderConfig() method, where user-supplied data is merged with the product's configuration:
$c = json_decode($product->getConfig() ?? '', true) ?? [];
$data = array_merge($c, $data);
return $data;
Since the user-controlled $data takes precedence over the original configuration $c, an attacker can override the configured hosting_plan_id without proper validation.
For example, consider a hosting provider offering two products:
- Cheap Hosting (Product ID: 2): Priced at $10.00 and configured with Hosting Plan ID 1, corresponding to a basic hosting plan in cPanel or a similar hosting control panel.
- Premium Hosting (Product ID: X): Priced at $1,000.00 and configured with Hosting Plan ID 2, corresponding to a premium hosting plan with higher resource limits in cPanel or a similar hosting control panel.
While ordering the $10.00 hosting product, an authenticated client can intercept the request to /api/guest/cart/add_item and inject "hosting_plan_id": 2 into the JSON body.
POST /api/guest/cart/add_item HTTP/1.1
Host: localhost
Content-Type: application/json
X-Requested-With: XMLHttpRequest
X-CSRF-Token: <valid-csrf-token>
{
"period": "1M",
"domain": {
"owndomain_sld": "example",
"owndomain_tld": ".com",
"action": "owndomain"
},
"multiple": "1",
"id": "2",
"hosting_plan_id": 2,
"CSRFToken": "<valid-csrf-token>"
}
Here in the above example request, id: 2 refers to the cheap hosting product ID, while hosting_plan_id: 2 refers to the premium hosting plan ID.
Interestingly, the attacker does not need to guess the available hosting plan IDs. The authenticated client API endpoint /api/client/servicehosting/hp_get_pairs exposes the configured hosting plan IDs and names:
{
"result": {
"1": "cheap",
"2": "premium"
},
"error": null
}
After submitting the modified request, the cart and invoice still display the cheap hosting product at its original $10.00 price. However, the order configuration stores the injected hosting_plan_id: 2, which is used during service provisioning.
As a result, a client/attacker can receive premium hosting resources, including increased disk space, bandwidth, databases, and other hosting quotas, while paying only for the cheaper product. This bypasses the intended service-tier restrictions and can cause financial losses for hosting providers.
Disclosure Timeline
- August 03, 2026: I reported the vulnerability through FOSSBilling's GitHub Security Advisory system.
- August 03, 2026: The FOSSBilling team validated the report and planned to release a patch in version 0.8.6.
- August 23, 2026: FOSSBilling released the patched version 0.8.6.
- September 11, 2026: FOSSBilling published the security advisory.
- October 01, 2026: GitHub assigned CVE-2026-103925 to the vulnerability.
References
- GitHub Security Advisory – GHSA-7vcc-24pp-x3wv
- FOSSBilling Security Fix – Pull Request #4093
- FOSSBilling v0.8.6 – Patched Release
