FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

An unauthenticated attacker sends an HTTP request to any `/api/system/:class/:method` endpoint. The API router accepts the role from the URL path, and the broken `isRoleAllowed()` method fails to reject the disallowed `system` role because the exception is constructed but never thrown [CWE-754, ref_id=1]. The `system` role is then mapped to the cron admin identity, so the request executes with full admin privileges, bypassing all login, session, and CSRF checks [ref_id=3].

The vulnerability resides in `src/modules/Api/Controller/Client.php` where the `isRoleAllowed()` method instantiates a new `Exception` for disallowed roles but omits the `throw` keyword, so the exception is never raised [ref_id=1]. Because `system` is not in the allowed list yet the method returns `true`, the request proceeds and the `system` role is mapped to the cron admin identity via `getCronAdmin()` in `src/di.php`, granting admin-context execution without authentication [ref_id=3].

The patch in version 0.8.0 adds the missing `throw` keyword so that the exception is actually raised when a disallowed role is passed to `isRoleAllowed()`. This prevents any request with the `system` role from reaching the admin API dispatch logic, closing the authorization bypass. The advisory also recommends blocking `/api/system/*` at a reverse proxy or WAF as an additional workaround [ref_id=3].