A security update for the HostBill OnApp module has just been released. Please update your OnApp module to the most recent version as soon as possible.

We were privately notified about an Insecure Direct Object Reference (IDOR) vulnerability in the OnApp module. It affects the entire 6.x branch of the module (all 6.x versions) released before this update. We have no evidence that this issue has been exploited or that it was publicly known before this disclosure.

Advisory details:

• Affected component: HostBill OnApp module
• Affected versions: all 6.x versions
• Severity: Critical
• Vulnerability class: Insecure Direct Object Reference (IDOR)
• Known public exploitation: none known
• Fixed in: 6.0.x.20261015 or higher

An Insecure Direct Object Reference occurs when an application gives access to a resource based on an identifier supplied in a request, without fully checking that the requester is allowed to access, modify or remove that resource. Because this type of issue can expose resources that belong to other accounts, we have rated it critical, and we strongly recommend applying the update without delay.

Resolution:

To fix this issue, update your OnApp module to the most recent release, version 6.0.x.20261015 or higher. You can update either manually or with the Auto-Update plugin.

If you have questions about this advisory or need help with the update, please contact our support team.

Acknowledgements:

We would like to thank Abstract DOO (abstract.rs), in particular Viktor Bajraktar and Mikica Ivosevic, for identifying this issue and disclosing it to us responsibly. Coordinated disclosure like theirs helps keep the HostBill safe, and we greatly appreciate it.