FOSSBilling CVE-2026-111048

The attacker must hold a FOSSBilling staff account with the support.manage_tickets permission to reach admin/support/note_create and plant a note (PR:L - not remote-unauthenticated). Exploitation then requires a second staff member to open that specific ticket's notes from the admin ticket list, which is the only vulnerable rendering path (UI:A). Limiting factors: only the admin ticket list is affected because mod_support_tickets.html.twig renders notes via innerHTML; the ticket detail page (mod_support_ticket.html.twig) is safe due to Twig autoescaping. Impact is maximized only when the viewer is a high-privileged account such as a Super Administrator. Affected default configurations are versions 0.1.0 through 0.8.8; no non-default setting is required to trigger it. Workarounds per the vendor: there is no complete fix without upgrading to 0.8.9; administrators can audit and remove notes containing HTML from the support_ticket_note table and revoke support.manage_tickets from staff groups that do not need it.

This is a genuine but access-gated priority rather than an internet-facing emergency. The CVSS 4.0 base score is 8.4 (High) with AV:N/AC:L/AT:N, but two metrics constrain real-world risk: PR:L means the attacker must already hold a staff account carrying the support.manage_tickets permission, and UI:A (passive/active user interaction) means the payload only fires when another staff member opens that ticket's notes from the admin ticket list. The vuln.today decision label is 'this_week', which aligns with a serious-but-not-drop-everything posture. No EPSS probability, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.4 is driven by high confidentiality and integrity impact (VC:H/VI:H) via privilege inheritance, not by exploitation signals. The standout risk factor is privilege escalation potential: a low-privileged staff member's payload executes with the viewing staff member's session, up to a Super Administrator, effectively turning a limited support role into full admin control. Net: a real priority for any multi-staff FOSSBilling deployment on 0.1.0-0.8.8, tempered by the authenticated-insider prerequisite and the absence of exploitation telemetry (EPSS/KEV both absent, so widespread opportunistic exploitation is not indicated).

A malicious or compromised staff member who holds only the support.manage_tickets permission creates a support ticket note containing a JavaScript payload via the admin/support/note_create endpoint. When a higher-privileged staff member - ideally a Super Administrator - later opens that ticket's notes from the admin ticket list, the admin UI renders the note through innerHTML and the script runs in the victim's authenticated session, reading the CSRF token and issuing admin API calls on their behalf. No public exploit is identified in the sources, but the advisory documents the exact vulnerable code path (div.innerHTML = entry.note) and the payload fires automatically as soon as the ticket_get response is parsed, without the victim interacting with the notes dialog.