CVE-2026-111048: FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/notecreate endpoint stores the note parameter without sanitization in the supportticketnote table, and src/modules/Support/templates/admin/modsupporttickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.managetickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.
Event History
Frequently Asked Questions
Which users can exploit this issue, and which users are at risk from it?
Any staff user granted the support.manage_tickets permission can create a malicious support-ticket note. The payload affects another staff member who opens the ticket notes, and it executes with that viewer's permissions, potentially including Super Administrator privileges.
Is every support-ticket view vulnerable?
No. The affected rendering path is the admin ticket list, where stored notes are inserted through innerHTML. The ticket detail page is not affected because its Twig rendering uses autoescaping.
What could an attacker do after a privileged staff member views a malicious note?
The script can read the viewer's CSRF token and client or invoice data accessible to that user. It can also perform administrative actions that the viewing staff member is authorized to perform.
What should be done if an immediate upgrade is not possible?
Limit the support.manage_tickets permission to trusted staff, since that permission is sufficient to store malicious note content. Avoid opening ticket notes created by untrusted or unknown staff until the issue is remediated.
Which versions need remediation?
Versions from 0.1.0 through 0.8.9 are identified as affected. The issue is fixed in version 0.8.9.