---
id: "CVE-2026-111056"
kind: "vulnerability"
aliases: ["CVE-2026-111056"]
title: "FOSSBilling: guest signup reveals whether an email is a client"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["fossbilling", "package", "php", "self-hosted"]
not_affected_if: ["guest-api-blocked", "version-0.8.7-or-later"]
published_at: "2026-10-19T16:17:03+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:40:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111056", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# FOSSBilling: guest signup reveals whether an email is a client

FOSSBilling's unauthenticated guest signup endpoint returns a distinct error when the submitted email already belongs to a client. An attacker can use this to confirm which email addresses hold accounts on a target billing instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FOSSBilling version in the admin panel or the project's composer/package metadata; versions up to `0.8.7` exclusive are affected.
- Send a POST to `/api/guest/client/create` with a known existing email and a new email from a test instance and compare the responses (unknown whether the sources give a exact response body).

## Fix

- Upgrade FOSSBilling to `0.8.7` or later.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111056

## From the sources

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_