Which versions of Open ISES Tickets are affected by CVE-2026-48246?

Open ISES Tickets before v3.44.2 exposes organizations running this incident management platform to credential theft and data exposure through a TLS verification flaw that enables attackers to…. A patch is available.

How to fix or mitigate CVE-2026-48246?

Within 24 hours: Identify all systems running Open ISES Tickets and document current versions. Within 7 days: Upgrade all affected installations to v3.44.2. Within 30 days: Rotate all Google Maps API keys associated with affected systems and conduct access log review for unauthorized API calls.

Open ISES Tickets CVE-2026-48246

Q: What is the CVSS score of CVE-2026-48246?

CVE-2026-48246 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31327 HIGH

Improper Certificate Validation (CWE-295)

2026-05-21 VulnCheck

GHSA-cm28-j57h-46hg

Information Disclosure PHP Google

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:36 vuln.today

Analysis Generated

May 21, 2026 - 18:36 vuln.today

Severity Changed

May 21, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

May 21, 2026 - 18:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

AnalysisAI

TLS certificate verification bypass in Open ISES Tickets before 3.44.2 allows network-positioned attackers to intercept HTTPS traffic between the application server and Google Maps Directions API during incident report generation. The flaw stems from ajax/reports.php explicitly setting CURLOPT_SSL_VERIFYPEER to false without configuring CURLOPT_SSL_VERIFYHOST, exposing Google API keys and any session-bearing data carried in outbound requests. No public exploit identified at time of analysis, and SSVC reports no observed exploitation, but a vendor patch is available in v3.44.2.

Technical ContextAI

Open ISES Tickets is a PHP-based incident reporting and ticketing application (CPE cpe:2.3:a:open_ises:tickets) that uses PHP's cURL library to make outbound HTTPS requests to the Google Maps Directions API for distance/route lookups embedded in incident reports. CWE-295 (Improper Certificate Validation) applies because the vulnerable code path disables peer certificate verification via CURLOPT_SSL_VERIFYPEER=false and omits CURLOPT_SSL_VERIFYHOST, meaning the TLS handshake will accept any certificate - including self-signed or attacker-forged ones - without validating the chain of trust or the hostname binding. Combined with the fact that Google API keys are typically transmitted as query-string parameters, any on-path adversary capable of intercepting the TCP session can act as a transparent TLS man-in-the-middle.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets v3.44.2 or later (https://github.com/openises/tickets/releases/tag/v3.44.2), which re-enables certificate verification by default and ships 87 additional security fixes (XSS, SQLi, hardcoded secrets), making the upgrade broadly worthwhile; the specific code fix is commit ecfeb406a016766cae81c749e14b5145a9f2dbff. If immediate patching is not possible, manually edit ajax/reports.php to remove the CURLOPT_SSL_VERIFYPEER=false override and explicitly set CURLOPT_SSL_VERIFYHOST=2, or disable the Google Maps Directions lookup feature entirely to eliminate the vulnerable outbound call (trade-off: incident reports will lose distance/route enrichment). As a network-layer compensating control, route the server's outbound HTTPS through a trusted egress proxy that enforces certificate validation, and rotate the exposed Google Maps API key after upgrading since it may have been transmitted over unverified TLS.