Live › vulnerability › CVE-2026-116257
Go to dashboardBillaBear (up to 2025.01.03) exposes POST /install/process (processInstall in InstallController.php) with no authentication. In the current main source the handler has no check that setup is already done: it creates the DB schema, system settings and a confirmed ROLE_ADMIN user from the request body. A public PoC exists and there is no vendor fix.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
Any self-hosted BillaBear instance at 2025.01.03 or earlier that is reachable over the network, including already-installed ones, because the code has no installed-state guard on the POST route. An attacker could create an admin account and change settings. Instances where /install/* is blocked at the proxy, or that sit behind a VPN or IP allowlist, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| billabear | packagist | <= 2025.01.03 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116257")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.