---
id: CVE-2026-111048
title: >-
  FOSSBilling: Low-privileged staff can run JavaScript in administrators'
  browsers via stored XSS in support ticket notes
summary: >-
  FOSSBilling is an open source billing and client-management platform. From
  0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note
  parameter without sanitization in the support_ticket_note table, and
  src/modules/Support…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: FOSSBilling
product: FOSSBilling
affected:
  - 'FOSSBilling >= 0.1.0, < 0.8.9'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T17:49:08.850823Z'
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:34:11.706Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111048'
references:
  - url: >-
      https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62
    label: >-
      https://github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-493h-fvcx-6q62
  - url: 'https://github.com/FOSSBilling/FOSSBilling/pull/4548'
    label: 'https://github.com/FOSSBilling/FOSSBilling/pull/4548'
  - url: >-
      https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6
    label: >-
      https://github.com/FOSSBilling/FOSSBilling/commit/87528920b6cb1ba6f113583253eb4d7abdd1d8c6
  - url: 'https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9'
    label: 'https://github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.9'
tags:
  - cve.org
epss: 0.00278
epssPercentile: 0.20349
ingestedAt: '2026-11-05T20:33:06.370Z'
---

## Overview

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.

## Affected

- `FOSSBilling >= 0.1.0, < 0.8.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.