Which versions of Open ISES Tickets are affected by CVE-2026-48239?

Open ISES Tickets versions prior to 3.44.2 contain a SQL injection vulnerability in the incident reporting interface that allows authenticated users to read, modify, or destroy incident data.. A patch is available.

How to fix or mitigate CVE-2026-48239?

Within 24 hours: Identify and document all Open ISES Tickets deployments and their current versions. Within 7 days: Upgrade all instances to version 3.44.2 or later; restrict POST access to ajax/reports.php to essential incident response personnel only. Within 30 days: Audit database transaction logs and incident report modification history to detect unauthorized tampering during the vulnerable window; verify database integrity of incidents table.

Open ISES Tickets CVE-2026-48239

Q: What is the CVSS score of CVE-2026-48239?

CVE-2026-48239 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31320 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-v5r4-5jjv-84fg

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:35 vuln.today

Analysis Generated

May 21, 2026 - 18:35 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with the incidents summary report query via the tick_id POST parameter in ajax/reports.php, enabling arbitrary read, modification, or destruction of database contents. The v3.44.2 release notes confirm the fix was part of a broader security overhaul addressing 19 SQL injection flaws and 69 XSS issues. No public exploit identified at time of analysis, and SSVC classifies exploitation status as 'none' with partial technical impact.

Technical ContextAI

Open ISES Tickets is a PHP-based incident ticketing application (CPE cpe:2.3:a:open_ises:tickets) used by emergency services. The flaw is a classic CWE-89 SQL Injection: user-controlled input from the tick_id POST parameter is concatenated directly into a SELECT statement's WHERE clause within the ajax/reports.php endpoint that builds the incidents summary report, without parameterization or input sanitization. The upstream commit ecfeb406a016766cae81c749e14b5145a9f2dbff in the openises/tickets GitHub repository introduces the corresponding fix, alongside 18 other SQLi remediations bundled into the same release.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets v3.44.2 or later, available at https://github.com/openises/tickets/releases/tag/v3.44.2; the specific fix commit is https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. Docker deployments can run 'docker compose pull && docker compose up -d', while traditional installs should extract the new zip over the existing installation and run the installer in Upgrade mode (legacy password hashes are auto-migrated, so no user resets are required). If immediate patching is not possible, restrict network access to ajax/reports.php via a WAF rule blocking suspicious tick_id values (single quotes, UNION, comment markers) and tighten authenticated user accounts to the minimum needed - note that WAF rules may produce false positives on legitimate ticket IDs and do not address the other 18 SQLi and 69 XSS issues fixed in the same release, so they are stopgaps only.