How severe is CVE-2026-43925?

CVE-2026-43925 has a CVSS 4.0 base score of 6.9, rated medium severity.

Is CVE-2026-43925 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-43925?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-43925 published?

CVE-2026-43925 was published on 2026-07-06 and last updated on 2026-07-07.

CVE-2026-43925

CVE-2026-43925 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-915.

Key facts

Severity: Medium (CVSS 4.0 base score 6.9)
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-915
Published: 2026-07-06
Last modified: 2026-07-07

Description

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).

Frequently asked questions

What is CVE-2026-43925?: FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign themselves to an arbitrary client group during sign-up. Because client groups can gate promo code eligibility, an attacker may apply group-restricted discount codes and receive unauthorized discounts. Version 0.8.0 contains a patch. As a workaround, administrators can either remove group restrictions from promo codes or disable client self-registration (Settings → Clients → Disable signup).
How severe is CVE-2026-43925?: CVE-2026-43925 has a CVSS 4.0 base score of 6.9, rated medium severity.
Is CVE-2026-43925 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-43925?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-43925 published?: CVE-2026-43925 was published on 2026-07-06 and last updated on 2026-07-07.

References

https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-q4rq-9844-r9w2

Other CWE-915 vulnerabilities

CVE-2026-50160 — Critical (CVSS 10.0): Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and…
CVE-2026-33453 — Critical (CVSS 10.0): Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap…
CVE-2025-58367 — Critical (CVSS 10.0): DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are…
CVE-2026-56142 — Critical (CVSS 9.9): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
CVE-2025-2304 — Critical (CVSS 9.4): A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the…
CVE-2025-24370 — Critical (CVSS 9.3): Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn…

Browse all CWE-915 vulnerabilities →