BillaBear: Installation handler missing authentication (CVE-2026-116257)
A vulnerability in the BillaBear Installation Handler (up to 2025.01.03) causes missing authentication within the processInstall function.
CVE search metadata
CVE search record: CVE-2026-116257. Severity: high. CVSS: 7.3. KEV: no. Product: BillaBear (up to 2025.01.03). Brief: BillaBear: Installation handler missing authentication (CVE-2026-116257). Brief link: https://feed.craftedsignal.io/briefs/2026-10-billabear-auth-bypass/
Triage facts
Revision 1- Applicability
- BillaBear (up to 2025.01.03)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 11:41 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-116257 identifies a missing authentication vulnerability in BillaBear versions up to 2025.01.03. The issue exists in the processInstall function of src/BillaBear/Controller/InstallController.php within the Installation Handler component. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was contacted but did not provide a response. The vulnerability has a CVSS v3.1 base score of 7.3.