FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has "staff.create_and_edit_staff" can call "/api/admin/staff/permissions_update" targeting their own account and write any permission structure, bypassing the intended role-based access control boundary. Version 0.8.0 patches the issue. Some workarounds are available. Restrict the "staff.create_and_edit_staff" permission to only highly trusted staff members and/or use a reverse proxy or WAF to restrict access to "/api/admin/staff/permissions_update" to specific trusted roles.