[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAH1YugcstgmRYmQFISk2zDX7mB1kEDoj_AlE6pocTTI":3,"g5a-risk:CVE-2026-53645":90},{"success":4,"data":5,"meta":87},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":29,"epssPercentile":30,"epssTimeSeries":31,"severity":32,"affectedProducts":33,"affectedProductsCount":34,"references":35,"referencesCount":40,"weaknesses":41,"weaknessesCount":40,"isActivelyExploited":50,"cisaInfo":30,"otxData":30,"relatedBlogPosts":51,"seoMetadata":52,"configurations":77,"relatedVendorCves":78,"notableEvents":79},"CVE-2026-53645","What is CVE-2026-53645?","FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has `staff.create_and_edit_staff` can call `\u002Fapi\u002Fadmin\u002Fstaff\u002Fpermissions_update` targeting their own account and write any permission structure, bypassing the intended role-based access control boundary. Version 0.8.0 patches the issue. Some workarounds are available. Restrict the `staff.create_and_edit_staff` permission to only highly trusted staff members and\u002For use a reverse proxy or WAF to restrict access to `\u002Fapi\u002Fadmin\u002Fstaff\u002Fpermissions_update` to specific trusted roles.","FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary modu...","2026-07-06T23:16:56.493","2026-07-07T14:16:32.857",8.5,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:H\u002FSI:H\u002FSA:L\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"CVSSMetricV31":15,"CVSSMetricV30":16,"CVSSMetricV2":17,"CVSSMetricV40":18},[],[],[],[19],{"Source":20,"Type":21,"CVSSData":22},"security-advisories@github.com","Secondary",{"Version":23,"VectorString":13,"BaseScore":12,"BaseSeverity":24,"AttackVector":25,"AttackComplexity":26,"AttackRequirements":27,"PrivilegesRequired":26,"UserInteraction":27,"VulnConfidentialityImpact":27,"VulnIntegrityImpact":24,"VulnAvailabilityImpact":27,"SubConfidentialityImpact":24,"SubIntegrityImpact":24,"SubAvailabilityImpact":26,"ExploitMaturity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedAttackRequirements":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedVulnConfidentialityImpact":28,"ModifiedVulnIntegrityImpact":28,"ModifiedVulnAvailabilityImpact":28,"ModifiedSubConfidentialityImpact":28,"ModifiedSubIntegrityImpact":28,"ModifiedSubAvailabilityImpact":28,"Safety":28,"Automatable":28,"Recovery":28,"ValueDensity":28,"VulnerabilityResponseEffort":28,"ProviderUrgency":28},"4.0","HIGH","NETWORK","LOW","NONE","NOT_DEFINED",0.00372,null,[29,29,29,29,29,29,29],"High",[],0,[36],{"url":37,"source":38,"tags":39},"https:\u002F\u002Fgithub.com\u002FFOSSBilling\u002FFOSSBilling\u002Fsecurity\u002Fadvisories\u002FGHSA-4hf7-xxxw-64rm","GitHub",[],1,[42],{"id":43,"name":44,"description":45,"extendedDescription":46,"status":47,"abstraction":48,"structure":49},"CWE-269","Improper Privilege Management","The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","","Draft","Class","Simple",false,[],{"title":53,"metaDescription":54,"keywords":55,"canonicalUrl":56,"structuredData":57},"What is CVE-2026-53645? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2026-53645, a high severity cyber security vulnerability from 2026. FOSSBilling is a free, open-source billing and client manag...","CVE-2026-53645, CVE-2026-53645 vulnerability, CVE-2026-53645 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation","\u002Fwhat-is\u002Fcve-2026-53645",{"@context":58,"@type":59,"headline":53,"description":54,"datePublished":10,"dateModified":11,"author":60,"publisher":64,"about":68,"mainEntityOfPage":72,"articleSection":75,"keywords":76},"https:\u002F\u002Fschema.org","TechArticle",{"@type":61,"name":62,"url":63},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":61,"name":62,"url":63,"logo":65},{"@type":66,"url":67},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":69,"name":6,"description":70,"additionalType":71},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":73,"@id":74},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2026-53645","Cybersecurity","CVE-2026-53645, CVE-2026-53645 vulnerability, CVE-2026-53645 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[],[],[80],{"id":81,"eventType":82,"eventTime":83,"details":84,"label":85,"color":86},"19402bf7-ec92-4211-a5f7-a2aa5651516a","NEW_NVD","2026-07-07T04:01:18.50557+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":88,"version":89},1793195657564,"2.0",{"score":91,"band":92,"action":93,"scoredAt":94},48,"Medium","Plan remediation","2026-10-28T07:16:54.118108+00:00"]