Threats affecting pkg:composer/billabear/billabear

CVE-2026-116257 is a vulnerability in BillaBear version 2025.01.03 affecting the Installation Handler component. Specifically, the processInstall function in src/BillaBear/Controller/InstallController.php lacks proper authentication, allowing remote attackers to exploit this flaw without credentials. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed with available exploit information. The vendor has not responded to the disclosure, and no patch or remediation is currently documented.