CERT24CVE-2026-116257 — BillaBear Installation InstallController.php processInstall missing authentication
A missing-authentication vulnerability was identified in BillaBear versions up to 2025.01.03. The affected function is processInstall in src/BillaBear/Controller/InstallController.php, part of the Installation Handler component. Remote exploitation is possible, and the exploit has been publicly disclosed and may be used. The vendor was contacted before disclosure but did not respond.