CVE-2026-48239 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. The issue occurs in ajax/reports.php where the tick_id POST parameter is unsafely concatenated into the WHERE clause of SQL SELECT statements used in the incidents summary report. Because the input is not sanitized, authenticated users can alter the SQL query semantics to access or manipulate the database beyond intended permissions. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1 and requires authentication but no user interaction.

An authenticated attacker can exploit this vulnerability to read, modify, or destroy database contents by injecting malicious SQL through the tick_id parameter. This could lead to unauthorized data disclosure, data corruption, or loss of data integrity within the Open ISES Tickets system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.44.2, upgrading to version 3.44.2 or later (if available) is recommended once confirmed by the vendor. Until an official fix is provided, restrict access to the affected component to trusted users only and monitor for suspicious activity involving the tick_id parameter.