A broken access control vulnerability in MagnusBilling v7.8.5.3 allows authenticated users to escalate privileges, posing a significant risk of unauthorized administrative access.

The flaw is a broken access control issue located in the user registration and management function at /mbilling/index.php/user/save. An authenticated user can send a crafted request to modify their own account status from pending to active, effectively bypassing required administrator approval.

Successful exploitation allows an attacker to gain elevated privileges within the billing system. This can lead to full unauthorized access to sensitive financial data, customer records, and system settings, potentially resulting in severe operational disruption and regulatory non-compliance. Given the CVSS score of 8.0, this is a high-severity risk that demands immediate attention.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should restrict registration access and monitor account creation processes closely. Review the provided GitHub commit history for the fix and apply the corresponding changes to the codebase.

Proactive Monitoring: Implement audit logging for all requests directed at the user management endpoints, specifically monitoring for unusual changes to account status parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests to /mbilling/index.php/user/save that contain unauthorized status modification attempts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in GitHub repository Whit3-d3viL-hacker/CVE-2025-52289.

The ability for a standard user to elevate their own privileges represents a critical failure in the application security model. Organizations currently running MagnusBilling v7.8.5.3 must prioritize the implementation of the vendor's fix or apply the necessary code patches to prevent unauthorized escalation. Continuous monitoring of user account changes is essential until the environment is fully secured.