CVE-2026-111048

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note create endpoint stores the note parameter without sanitization in the support ticket note table, and src/modules/Support/templates/admin/mod support tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.