CVE-2026-40495

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 leak the exact system version through asset cache buster parameters in HTML output, bypassing the `hide_version_public` security setting. The FOSSBilling version is embedded in the query string of every `<script>` and `<link>` tag generated by the `script_tag` and `stylesheet_tag` Twig filters. This information is visible to all visitors — including unauthenticated guests — on every page, regardless of whether the `hide_version_public` setting is enabled. The `X-FOSSBilling-Version` HTTP header and the `guest.system.version` API endpoint correctly honour the `hide_version_public` setting, but the asset cache buster parameters were overlooked. Knowledge of the exact FOSSBilling version makes it significantly easier for malicious actors to identify known vulnerabilities applicable to a given installation and craft targeted exploits. While not a direct vulnerability on its own, it undermines the intended protection offered by the `hide_version_public` setting and facilitates reconnaissance. Version 0.8.0 contains a patch. There is no practical workaround that removes the version from asset URLs without modifying source code.

• CWE-200

• https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.0
• https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-gqcp-g7rm-p5v6

Published

Jun 3, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4049Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-40490The AsyncHttpClient (AHC) library allows Java applications t…6.8
• CVE-2026-40491gdown is a Google Drive public file/folder downloader. Versi…7.8
• CVE-2026-40492SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40493SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40494SAIL is a cross-platform library for loading and saving imag…9.8
• CVE-2026-40496FreeScout is a free self-hosted help desk and shared mailbox…9.1
• CVE-2026-40497FreeScout is a free self-hosted help desk and shared mailbox…8.1
• CVE-2026-40498FreeScout is a free self-hosted help desk and shared mailbox…9.8
• CVE-2026-40499radare2 prior to version 6.1.4 contains a command injection …7.8
• CVE-2026-40500Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-40501Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit…8.8