CVE-2026-112374

    Dashboard / Vulnerabilities / CVE-2026-112374

    CVE-2026-112374

    Published: 30 Oct 2026Last Modified: 9 Nov 2026

    Summary: FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API

    Details: FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() only allowlists client_login and client_create, leaving staff_login without CSRF or Origin validation. Attackers can host an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112374.json, https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-h7w3-wp25-gf86, https://nvd.nist.gov/vuln/detail/CVE-2026-112374, https://www.vulncheck.com/advisories/fossbilling-before-login-csrf-via-staff-guest-login-api, https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9, https://github.com/FOSSBilling/FOSSBilling

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 469046158e66d47fa4976703657016961abff3a1
    Fixed -e594f8a5f91ea4cc905708f8dc1e42ccb752ed21

    Affected versions

    0.8.8
    0.8.7
    0.8.6
    0.8.5
    0.8.4
    0.8.3
    0.8.2
    0.8.1
    0.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-112374 | CVE-DB