{"id":"CVE-2026-116257","kind":"vulnerability","aliases":["CVE-2026-116257"],"related":[],"title":"BillaBear: installer endpoint lacks authentication, allowing remote takeover","description":"A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"BillaBear (up to 2025.01.03) exposes POST /install/process (processInstall in InstallController.php) with no authentication. In the current main source the handler has no check that setup is already done: it creates the DB schema, system settings and a confirmed ROLE_ADMIN user from the request body. A public PoC exists and there is no vendor fix.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"billabear","fixed":[],"affected":"<= 2025.01.03","ecosystem":"packagist"}],"ecosystems":[],"tags":["billabear","billing","package","php","self-hosted","symfony"],"not_affected_if":["installer-disabled","installer-route-blocked","managed-hosting","network-restricted"],"how_to_check":"- Check your BillaBear version; 2025.01.03 and earlier are listed as affected, and no fixed release is known.\n- From outside your network, send a POST to https://<host>/install/process (an empty JSON body is enough to see the response). Do not send valid data to a production instance. A validation error or any response from the controller, rather than a 403/404 from the proxy, means the route is reachable.\n- Search web logs for POST /install/process from unknown IPs, and review the admin users in the users table for accounts you did not create.","fix":"No fixed version: the vendor has not responded and I found no patch or advisory. Workaround: block /install and /install/process at the web server or reverse proxy once setup is done (allow them only from trusted IPs during installation).","status":"open","published_at":"2026-10-26T11:16:37+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","triaged_at":"2026-10-26T11:30:56+00:00","updated_at":"2026-10-26T11:32:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T11:30:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BillaBear: installer endpoint lacks authentication, allowing remote takeover","impact":"high","summary":"BillaBear's installation handler, processInstall in InstallController.php, does not check authentication. A remote attacker can reach the install flow without credentials, and the exploit is public.","category":"package","nicknames":[],"who_cares":["billabear","self-hosted","php","billing"],"confidence":0.5,"needs_auth":"no","worst_case":"unauthenticated attacker reaches install logic and may take over the instance","analyst_note":"Find a vendor or advisory fix version and confirm what processInstall allows after setup; the sources say the vendor did not respond.","how_to_check":"- Check the installed BillaBear version and compare it with `2025.01.03`\n- Confirm whether the install route (InstallController) is still reachable on the running instance, for example by requesting the installer path on a test host\n- Review web server logs for requests to the installer path from unknown sources","needs_analyst":true,"not_affected_if":["managed-hosting","installer-disabled"],"who_is_affected":"Any self-hosted BillaBear instance at version 2025.01.03 or earlier that exposes the installer route to the network. Instances where installation was completed and the installer route is blocked or removed are less exposed. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000586,"input_tokens":3345,"output_tokens":504,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find a vendor or advisory fix version and confirm what processInstall allows after setup; the sources say the vendor did not respond.","search":"'-116257':11A,14A '-2026':10A,13A '/install/process':30B '2025.01.03':27B,87C 'admin':63B 'affect':88C 'allow':6A 'alreadi':50B 'attack':114C 'authent':5A,36B,109C 'bill':17B 'billabear':1A,15A,16B,24B,84C 'bodi':68B 'caus':107C 'check':46B 'compon':102C 'confirm':61B 'contact':130C 'creat':53B 'current':39B 'cve':9A,12A 'db':55B 'determin':82C 'disclos':122C 'disclosur':134C 'done':51B 'earli':131C 'endpoint':3A 'exist':72B 'exploit':111C,118C 'expos':28B 'file':98C 'fix':78B 'function':94C 'handler':43B,104C 'host':22B 'instal':2A,103C 'installcontroller.php':33B 'issu':91C 'lack':4A 'main':40B 'manipul':106C 'may':124C 'miss':108C 'packag':18B 'php':19B 'poc':71B 'possibl':116C 'post':29B 'processinstal':31B,95C 'public':70B,121C 'remot':7A,110C 'request':67B 'respond':138C 'role':62B 'schema':56B 'self':21B 'self-host':20B 'set':58B 'setup':48B 'sourc':41B 'src/billabear/controller/installcontroller.php':99C 'symfoni':23B 'system':57B 'takeov':8A 'user':64B 'util':126C 'vendor':77B,128C 'vulner':80C 'way':141C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted BillaBear instance at 2025.01.03 or earlier that is reachable over the network, including already-installed ones, because the code has no installed-state guard on the POST route. An attacker could create an admin account and change settings. Instances where /install/* is blocked at the proxy, or that sit behind a VPN or IP allowlist, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116257","severity":null,"published_at":"2026-10-26T11:16:37+00:00","modified_at":"2026-10-26T11:16:37+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","fetched_at":"2026-10-26T11:29:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116257:829","url":null,"severity":null,"published_at":"2026-10-26T11:32:23+00:00","modified_at":"2026-10-26T11:32:23+00:00","first_seen_at":"2026-10-26T11:32:23+00:00","fetched_at":"2026-10-26T11:32:23+00:00","note":"No vendor advisory or fix exists (vendor silent per VulDB VDB-426296; PoC is a gist, not fetched). BillaBear main InstallController::processInstall (POST /install/process) has no auth and no 'already installed' guard in the code I read: it creates the DB schema, settings and an admin user from the request body. Whether it still works after setup is inferred from the code, not tested."}],"documents":[{"id":3799,"url":"https://vuldb.com/vuln/426296","title":"VulDB VDB-426296: BillaBear processInstall missing authentication","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3800,"url":"https://raw.githubusercontent.com/billabear/billabear/main/src/BillaBear/Controller/InstallController.php","title":"BillaBear InstallController.php (main)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}