Is there a patch available for CVE-2026-48226?

Yes, a patch is available for CVE-2026-48226. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48226

Q: What is the CVSS score of CVE-2026-48226?

CVE-2026-48226 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31308 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 VulnCheck

GHSA-mr4v-2w86-qpfp

PHP XSS

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:44 vuln.today

Analysis Generated

May 21, 2026 - 18:44 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ref and mode_orig POST parameters directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.

AnalysisAI

Reflected XSS in Open ISES Tickets (all versions before 3.44.2) allows JavaScript injection via the unsanitized ref and mode_orig POST parameters in os_watch.php, which are written verbatim into HTML form hidden input value attributes without output encoding. An attacker who can trick a user into submitting a crafted POST request will have arbitrary JavaScript execute in that user's browser session, enabling session theft, credential harvesting, or UI redress attacks. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the patch release simultaneously addressed 88 vulnerabilities - including 19 SQL injection issues - suggesting this application carried significant accumulated security debt that amplifies organizational risk beyond this single CVE.

Technical ContextAI

Open ISES Tickets is a PHP-based helpdesk/ticketing application (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): user-supplied POST parameter values (ref, mode_orig) in os_watch.php are concatenated directly into the value attribute of HTML hidden input fields without HTML-encoding or any server-side sanitization. An attacker closes the attribute with a quote character and injects an event handler or script tag. Because the payload is reflected from the POST body rather than stored, each exploitation attempt requires a fresh crafted HTTP request delivered to the victim. The vulnerability exists in the PHP tag open_ises/tickets across all versions from 0 up to (but not including) 3.44.2 per EUVD-2026-31308 and NVD CPE data.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately - this is a critical security release that patches 88 vulnerabilities including 69 XSS and 19 SQL injection issues, not just this CVE. For Docker deployments run docker compose pull && docker compose up -d. For traditional deployments, download the v3.44.2 zip from https://github.com/openises/tickets/releases/tag/v3.44.2, extract over the existing install, and run the installer in Upgrade mode. The patch commit is available at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff for reference. If immediate patching is not possible and the system is internet-facing, restrict access to os_watch.php at the web server layer (e.g., block POST requests to that endpoint via WAF or nginx location directive) as a temporary compensating control - note this may break legitimate functionality for users of that feature. Given the concurrent SQL injection vulnerabilities in the same release, exposing an unpatched instance to untrusted users should be treated as a high-priority risk regardless of this CVE's individual CVSS score.