CVE-2026-111048
Deferred Deferred - Pending Action

Stored XSS in FOSSBilling Admin Support Notes

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: GitHub, Inc.

Description
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-111048

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FOSSBilling FOSSBilling >= 0.1.0, < 0.8.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FOSSBilling versions 0.1.0 to 0.8.9 have a stored cross-site scripting (XSS) vulnerability in the admin/support/note_create endpoint. The note parameter is stored unsanitized in the database and rendered without autoescaping in the admin ticket list. This allows a staff user with support.manage_tickets permission to inject malicious scripts that execute when another staff member views the ticket notes.

Detection Guidance

Check FOSSBilling versions prior to 0.8.9 for unsanitized notes in the support_ticket_note table. Review admin ticket lists for stored scripts or HTML in notes. Inspect browser console for executed scripts when viewing tickets.

Impact Analysis

An attacker with limited privileges can execute arbitrary JavaScript in the context of another staff member's session. This could allow them to read sensitive data like CSRF tokens, client information, or invoices, and perform administrative actions such as modifying or deleting records.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, unauthorized modifications, and non-compliance with privacy and security standards.

Mitigation Strategies

Upgrade FOSSBilling to version 0.8.9 or later immediately. Review existing support ticket notes for malicious scripts and remove them. Audit staff accounts with support.manage_tickets permission for unauthorized actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...