CVE-2026-27708 | FOSSBilling up to 0.7.x Servicecustom Client API order_id access control (GHSA-p36w-9×66-488j)

A vulnerability described as critical has been identified in FOSSBilling up to 0.7.x. Affected by this vulnerability is an unknown functionality of the component Servicecustom Client API. The manipulation of the argument order_id results in improper access controls.

This vulnerability is known as CVE-2026-27708. It is possible to launch the attack remotely. No exploit is available.

Upgrading the affected component is recommended.