CVE-2026-116257 | BillaBear up to 2025.01.03 Installation InstallController.php processInstall missing authentication

October 25, 2026 Yanac

A vulnerability identified as critical has been detected in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication.

This vulnerability is registered as CVE-2026-116257. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More