CVE-2026-43924

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43924", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-04T16:59:09.089Z", "datePublished": "2026-06-03T19:56:25.836Z", "dateUpdated": "2026-06-04T12:37:01.016Z"}, "containers": {"cna": {"title": "FOSSBilling has an open redirect via administrator-configured redirect targets", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-v8rf-g37v-vgpx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-v8rf-g37v-vgpx"}, {"name": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0"}], "affected": [{"vendor": "FOSSBilling", "product": "FOSSBilling", "versions": [{"version": "< 0.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-03T19:56:25.836Z"}, "descriptions": [{"lang": "en", "value": "FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module does not validate the URL scheme of administrator-configured destination URLs before storing or issuing redirects. This allows arbitrary external URLs to be configured as redirect targets, creating an open redirect vulnerability exploitable for phishing attacks. Users following a legitimate FOSSBilling URL can be silently redirected to an attacker-controlled external site. The redirect is issued as a 301 (Moved Permanently) response, which browsers cache persistently, amplifying the impact. Exploitation requires administrator privileges to create or modify redirect entries, limiting practical attack scenarios to multi-admin environments or compromised admin accounts. Version 0.8.0 fixes the issue. Some workarounds are available. Restrict admin access to the Redirect module to trusted administrators only and/or audit existing redirect entries in the database (the `extension_meta` table with `extension = 'mod_redirect'`) for any unexpected or external target URLs."}], "source": {"advisory": "GHSA-v8rf-g37v-vgpx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-04T12:36:50.988014Z", "id": "CVE-2026-43924", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:37:01.016Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-04T12:36:50.988014Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-04T12:36:57.354Z"}}], "cna": {"title": "FOSSBilling has an open redirect via administrator-configured redirect targets", "source": {"advisory": "GHSA-v8rf-g37v-vgpx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "FOSSBilling", "product": "FOSSBilling", "versions": [{"status": "affected", "version": "< 0.8.0"}]}], "references": [{"url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-v8rf-g37v-vgpx", "name": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-v8rf-g37v-vgpx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0", "name": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module does not validate the URL scheme of administrator-configured destination URLs before storing or issuing redirects. This allows arbitrary external URLs to be configured as redirect targets, creating an open redirect vulnerability exploitable for phishing attacks. Users following a legitimate FOSSBilling URL can be silently redirected to an attacker-controlled external site. The redirect is issued as a 301 (Moved Permanently) response, which browsers cache persistently, amplifying the impact. Exploitation requires administrator privileges to create or modify redirect entries, limiting practical attack scenarios to multi-admin environments or compromised admin accounts. Version 0.8.0 fixes the issue. Some workarounds are available. Restrict admin access to the Redirect module to trusted administrators only and/or audit existing redirect entries in the database (the `extension_meta` table with `extension = 'mod_redirect'`) for any unexpected or external target URLs."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-03T19:56:25.836Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43924", "state": "PUBLISHED", "dateUpdated": "2026-06-04T12:37:01.016Z", "dateReserved": "2026-05-04T16:59:09.089Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-03T19:56:25.836Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FOSSBilling", "vendor": "FOSSBilling", "versions": [{"status": "affected", "version": "< 0.8.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module does not validate the URL scheme of administrator-configured destination URLs before storing or issuing redirects. This allows arbitrary external URLs to be configured as redirect targets, creating an open redirect vulnerability exploitable for phishing attacks. Users following a legitimate FOSSBilling URL can be silently redirected to an attacker-controlled external site. The redirect is issued as a 301 (Moved Permanently) response, which browsers cache persistently, amplifying the impact. Exploitation requires administrator privileges to create or modify redirect entries, limiting practical attack scenarios to multi-admin environments or compromised admin accounts. Version 0.8.0 fixes the issue. Some workarounds are available. Restrict admin access to the Redirect module to trusted administrators only and/or audit existing redirect entries in the database (the `extension_meta` table with `extension = 'mod_redirect'`) for any unexpected or external target URLs."}, {"lang": "es", "value": "FOSSBilling es un sistema de facturaci\u00f3n y gesti\u00f3n de clientes gratuito y de c\u00f3digo abierto. Antes de la versi\u00f3n 0.8.0, el m\u00f3dulo Redirect no valida el esquema de URL de las URL de destino configuradas por el administrador antes de almacenar o emitir redirecciones. Esto permite que se configuren URL externas arbitrarias como objetivos de redirecci\u00f3n, creando una vulnerabilidad de redirecci\u00f3n abierta explotable para ataques de phishing. Los usuarios que siguen una URL leg\u00edtima de FOSSBilling pueden ser redirigidos silenciosamente a un sitio externo controlado por un atacante. La redirecci\u00f3n se emite como una respuesta 301 (Movido Permanentemente), que los navegadores almacenan en cach\u00e9 de forma persistente, amplificando el impacto. La explotaci\u00f3n requiere privilegios de administrador para crear o modificar entradas de redirecci\u00f3n, limitando los escenarios de ataque pr\u00e1cticos a entornos multiadministrador o cuentas de administrador comprometidas. La versi\u00f3n 0.8.0 corrige el problema. Algunas soluciones alternativas est\u00e1n disponibles. Restrinja el acceso de administrador al m\u00f3dulo Redirect solo a administradores de confianza y/o audite las entradas de redirecci\u00f3n existentes en la base de datos (la tabla 'extension_meta' con 'extension = 'mod_redirect'') en busca de URL de destino inesperadas o externas."}], "id": "CVE-2026-43924", "lastModified": "2026-07-22T20:10:00.127", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43924", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-04T12:36:50.988014Z", "version": "2.0.3"}}]}, "published": "2026-06-03T20:16:21.133", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-v8rf-g37v-vgpx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.8.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FOSSBilling", "source": "cna", "vendor": "FOSSBilling"}, "product": "fossbilling", "vendor": "fossbilling"}], "created": "2026-06-03T21:30:32.703607+00:00", "updated": "2026-06-03T22:00:13.435448+00:00", "vendors": ["fossbilling", "fossbilling$PRODUCT$fossbilling"]}