BillaBear (Up to 2025.01.03) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/billabear-up-to-2025.01.03/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 11:41:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBillaBear: Installation handler missing authentication (CVE-2026-116257)https://feed.craftedsignal.io/briefs/2026-10-billabear-auth-bypass/Mon, 26 Oct 2026 11:41:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-billabear-auth-bypass/A vulnerability in the BillaBear Installation Handler (up to 2025.01.03) causes missing authentication within the processInstall function.CVE-2026-116257 identifies a missing authentication vulnerability in BillaBear versions up to 2025.01.03. The issue exists in the processInstall function of src/BillaBear/Controller/InstallController.php within the Installation Handler component. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor was contacted but did not provide a response. The vulnerability has a CVSS v3.1 base score of 7.3.

]]>highadvisory