{"id":"CVE-2026-111048","kind":"vulnerability","aliases":["CVE-2026-111048"],"related":[],"title":"FOSSBilling: stored XSS in support ticket notes hits admins","description":"FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.","summary":"FOSSBilling stores support ticket notes without sanitizing them and renders them as raw HTML in the admin ticket list. A staff member with only ticket permissions can plant a script that runs in the session of another staff member, including a Super Administrator, and perform actions as them.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["billing","fossbilling","package","self-hosted"],"not_affected_if":["no-staff-ticket-access","version-0.8.9-or-later"],"how_to_check":"- Check the installed FOSSBilling version and whether it is below `0.8.9`.\n- Look at `src/modules/Support/templates/admin/mod_support_tickets.html.twig` for ticket notes rendered through `innerHTML`.","fix":"- FOSSBilling: move to version `0.8.9`.","status":"open","published_at":"2026-11-02T18:18:35+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:34+00:00","updated_at":"2026-11-02T18:24:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-02T18:24:34Z","model":"claude-haiku-5-5","output":{"fix":"- FOSSBilling: move to version `0.8.9`.","reach":"network","title":"FOSSBilling: stored XSS in support ticket notes hits admins","impact":"high","summary":"FOSSBilling stores support ticket notes without sanitizing them and renders them as raw HTML in the admin ticket list. A staff member with only ticket permissions can plant a script that runs in the session of another staff member, including a Super Administrator, and perform actions as them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["fossbilling","self-hosted","billing"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs as a Super Administrator, reading tokens and data","analyst_note":"","how_to_check":"- Check the installed FOSSBilling version and whether it is below `0.8.9`.\n- Look at `src/modules/Support/templates/admin/mod_support_tickets.html.twig` for ticket notes rendered through `innerHTML`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.8.9-or-later","no-staff-ticket-access"],"who_is_affected":"Any FOSSBilling installation from 0.1.0 through 0.8.9 where staff use the admin support ticket list is exposed. The ticket detail page is not affected because its rendering is escaped. Installations that are already on 0.8.9 or later can skip this.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4324,"output_tokens":537,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111048':12A,15A '-2026':11A,14A '0.1.0':80C '0.8.9':82C,192C 'access':155C 'action':67B,164C 'admin':9A,38B,110C 'admin/support/note_create':84C 'administr':64B,163C,172C 'affect':179C 'anoth':58B,130C 'autoescap':185C 'avail':165C 'bill':16B,73C 'client':76C,156C 'client-manag':75C 'csrf':152C 'cve':10A,13A 'data':159C 'detail':175C 'endpoint':85C 'execut':128C 'fix':189C 'fossbil':1A,17B,22B,68C 'hit':8A 'host':21B 'html':35B,124C 'includ':61B,169C 'innerhtml':107C 'invoic':158C 'issu':187C 'javascript':126C 'list':40B,112C 'manag':77C 'member':43B,60B,132C,144C 'note':7A,26B,88C,96C,105C,136C 'open':71C,133C 'packag':18B 'page':176C 'paramet':89C 'perform':66B,162C 'permiss':47B,121C 'plant':49B 'platform':78C 'privileg':148C 'raw':34B 'read':150C 'render':31B,100C,183C 'run':53B,139C 'sanit':28B,91C 'script':51B,138C 'self':20B 'self-host':19B 'session':56B,146C 'sourc':72C 'src/modules/support/templates/admin/mod_support_tickets.html.twig':99C 'staff':42B,59B,114C,131C,143C 'store':2A,23B,86C,102C,123C 'super':63B,171C 'support':5A,24B,94C,103C 'support.manage':119C 'tabl':97C 'ticket':6A,25B,39B,46B,95C,104C,111C,120C,135C,174C 'token':153C 'twig':182C 'use':184C 'user':115C 'version':191C 'view':142C 'viewer':168C 'without':27B,90C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Any FOSSBilling installation from 0.1.0 through 0.8.9 where staff use the admin support ticket list is exposed. The ticket detail page is not affected because its rendering is escaped. Installations that are already on 0.8.9 or later can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["billing","fossbilling","high","package","selfhosted"],"first_public_at":"2026-10-27T15:36:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111048","severity":null,"published_at":"2026-11-02T18:18:35+00:00","modified_at":"2026-11-02T18:18:35+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null}],"documents":[{"id":53247,"url":"https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":49619,"url":"https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":53249,"url":"https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-27T15:36:29+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}