Live › vulnerability › CVE-2026-111048
FOSSBilling stores support ticket notes without sanitizing them and renders them as raw HTML in the admin ticket list. A staff member with only ticket permissions can plant a script that runs in the session of another staff member, including a Super Administrator, and perform actions as them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 18:24 UTC. All times on this page are UTC.
Any FOSSBilling installation from 0.1.0 through 0.8.9 where staff use the admin support ticket list is exposed. The ticket detail page is not affected because its rendering is escaped. Installations that are already on 0.8.9 or later can skip this.
No product ranges from the sources yet.
0.8.9.src/modules/Support/templates/admin/mod_support_tickets.html.twig for ticket notes rendered through innerHTML.0.8.9.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-111048")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.