---
id: "CVE-2026-116257"
kind: "vulnerability"
aliases: ["CVE-2026-116257"]
title: "BillaBear: installer endpoint lacks authentication, allowing remote takeover"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "billabear", "fixed": [], "affected": "<= 2025.01.03", "ecosystem": "packagist"}]
ecosystems: []
tags: ["billabear", "billing", "package", "php", "self-hosted", "symfony"]
not_affected_if: ["installer-disabled", "installer-route-blocked", "managed-hosting", "network-restricted"]
published_at: "2026-10-26T11:16:37+00:00"
first_seen_at: "2026-10-26T11:29:41+00:00"
updated_at: "2026-10-26T11:32:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116257", "first_seen_at": "2026-10-26T11:29:41+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-26T11:32:23+00:00"}]
---

# BillaBear: installer endpoint lacks authentication, allowing remote takeover

BillaBear (up to 2025.01.03) exposes POST /install/process (processInstall in InstallController.php) with no authentication. In the current main source the handler has no check that setup is already done: it creates the DB schema, system settings and a confirmed ROLE_ADMIN user from the request body. A public PoC exists and there is no vendor fix.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- packagist:billabear affected <= 2025.01.03 fixed ?

## How to check

- Check your BillaBear version; 2025.01.03 and earlier are listed as affected, and no fixed release is known.
- From outside your network, send a POST to https://<host>/install/process (an empty JSON body is enough to see the response). Do not send valid data to a production instance. A validation error or any response from the controller, rather than a 403/404 from the proxy, means the route is reachable.
- Search web logs for POST /install/process from unknown IPs, and review the admin users in the users table for accounts you did not create.

## Fix

No fixed version: the vendor has not responded and I found no patch or advisory. Workaround: block /install and /install/process at the web server or reverse proxy once setup is done (allow them only from trusted IPs during installation).

## Timeline

- 2026-10-26T11:29:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116257
- 2026-10-26T11:32:23+00:00 analyst — No vendor advisory or fix exists (vendor silent per VulDB VDB-426296; PoC is a gist, not fetched). BillaBear main InstallController::processInstall (POST /install/process) has no auth and no 'already installed' guard in the code I read: it creates the DB schema, settings and an admin user from the request body. Whether it still works after setup is inferred from the code, not tested.

## Documents

- [advisory] VulDB VDB-426296: BillaBear processInstall missing authentication https://vuldb.com/vuln/426296
- [describes] BillaBear InstallController.php (main) https://raw.githubusercontent.com/billabear/billabear/main/src/BillaBear/Controller/InstallController.php

## From the sources

A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_