CVE-2026-43925
Description
FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).
Is your site exposed to CVE-2026-43925?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-43925? +
How do I check if I'm vulnerable to CVE-2026-43925? +
Related Vulnerabilities
Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control …
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, …
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied …