The vulnerability allows a staff user with only support.manage_tickets permission to store arbitrary HTML or JavaScript in support ticket notes. When another staff member, including administrators, opens the ticket list, the note is rendered through innerHTML in the admin ticket list template without sanitization. The injected script executes with the session of the viewing user, granting the attacker the same privileges as the victim, enabling reading of CSRF tokens, accessing client or invoice data, and performing any administrative action available to that user, including that of a Super Administrator. This is a classic stored cross‑site scripting flaw that results in remote code execution and privilege escalation due to the script running with the victim's privileges.

The flaw exists in FOSSBilling versions 0.1.0 through 0.8.9. The affected component is the admin/support/note_create endpoint, which stores the note parameter without sanitization in the support_ticket_note table. The rendering template src/modules/Support/templates/admin/mod_support_tickets.html.twig displays each stored support ticket note via innerHTML in the admin ticket list. The ticket detail page uses autoescaping and is not affected. Updating to 0.8.9 or later fixes the issue.

The CVSS scoring of 8.4 indicates a high severity vulnerability. The EPSS score is not available, so the current exploitation probability is not quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that a low‑privileged staff member creates a malicious support ticket note, and a higher‑privileged staff member opens the ticket, triggering execution of the injected script. This attack requires authenticated access to the FOSSBilling platform, but the attacker only needs the minimal support.manage_tickets permission, making it easy to perform. The impact includes potential full system compromise if the victim is a Super Administrator.