Live › vulnerability › CVE-2026-111056
Go to dashboardFOSSBilling's unauthenticated guest signup endpoint returns a distinct error when the submitted email already belongs to a client. An attacker can use this to confirm which email addresses hold accounts on a target billing instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any self-hosted FOSSBilling instance from 0.1.0 through that exposes its API to the internet is exposed, since the endpoint needs no login. Instances where the guest API is blocked at the network or reverse-proxy layer are less exposed. Teams already on or later are not affected.
0.8.60.8.7No product ranges from the sources yet.
0.8.7 exclusive are affected./api/guest/client/create with a known existing email and a new email from a test instance and compare the responses (unknown whether the sources give a exact response body).0.8.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-111056")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.