CVE-2026-48239 is a SQL injection vulnerability in Open ISES Tickets affecting versions prior to 3.44.2. The issue exists in ajax/reports.php where the tick_id POST parameter is unsafely concatenated into SQL queries used for incident summary reports. This improper neutralization of special elements in SQL commands allows authenticated users to manipulate the SQL query semantics, potentially leading to unauthorized data access or modification within the database. The vulnerability is rated with a CVSS 4.0 score of 7.1 (high severity). There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

An authenticated attacker can exploit this SQL injection vulnerability to read, modify, or destroy database contents of the Open ISES Tickets system. This can lead to unauthorized disclosure, data integrity compromise, and potential denial of service through data destruction. The vulnerability affects the confidentiality, integrity, and availability of the impacted system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected ajax/reports.php functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the tick_id parameter.