Which versions of Open ISES Tickets are affected by CVE-2026-48247?

Open ISES Tickets versions prior to 3.44.2 expose sensitive credentials like API keys and session data to network-based interception, directly threatening integrated system security and user account…. A patch is available.

How to fix or mitigate CVE-2026-48247?

24 hours: Identify and document all Open ISES Tickets instances and current versions in your environment. 7 days: Deploy vendor patch to upgrade all instances to v3.44.2, beginning with non-production systems to validate compatibility. 30 days: Audit logs and integrations to verify no unauthorized credential access; rotate any API keys or credentials managed through ISES Tickets as a precautionary measure.

Open ISES Tickets CVE-2026-48247

Q: What is the CVSS score of CVE-2026-48247?

CVE-2026-48247 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31326 HIGH

Improper Certificate Validation (CWE-295)

2026-05-21 VulnCheck

GHSA-24vx-5h6h-8q7m

Information Disclosure PHP

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:33 vuln.today

Analysis Generated

May 21, 2026 - 18:33 vuln.today

Severity Changed

May 21, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

May 21, 2026 - 18:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for general-purpose outbound HTTPS requests issued by the shared helper functions. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

AnalysisAI

Man-in-the-middle exposure in Open ISES Tickets before 3.44.2 stems from the shared helper functions in incs/functions.inc.php disabling TLS certificate verification (CURLOPT_SSL_VERIFYPEER=false) on outbound HTTPS calls, letting network-positioned attackers intercept or modify traffic carrying API keys and session data. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the vendor's v3.44.2 release notes describe it as a critical security update that also bundles fixes for 88 other issues including XSS and SQL injection.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing/incident-tracking application (cpe:2.3:a:open_ises:tickets) that relies on PHP's libcurl bindings for outbound HTTPS requests through helper functions in incs/functions.inc.php. The defect is a CWE-295 (Improper Certificate Validation) instance: the code explicitly sets CURLOPT_SSL_VERIFYPEER to false and never sets CURLOPT_SSL_VERIFYHOST, so cURL skips both chain-of-trust validation and hostname matching, accepting any certificate - including self-signed or attacker-forged ones - presented by whatever host responds on the TCP connection. Because these helpers are general-purpose, every outbound HTTPS call routed through them (third-party APIs, tile services, integration endpoints) inherits the broken trust model, which is why the v3.44.2 release notes specifically cite four SSL certificate validation issues that now verify by default.

RemediationAI

Vendor-released patch: 3.44.2 - upgrade immediately via 'docker compose pull && docker compose up -d' for Docker deployments or by extracting the release zip over the existing install and running the installer in Upgrade mode for traditional deployments, as documented at https://github.com/openises/tickets/releases/tag/v3.44.2; the underlying code change is in commit ecfeb406a016766cae81c749e14b5145a9f2dbff. If patching must be deferred, route all outbound HTTPS traffic from the Tickets server through an egress proxy that enforces certificate validation on its own (e.g., a forward TLS-inspecting proxy or a strict outbound firewall that only permits connections to known-good IPs over verified TLS), rotate any API keys or session tokens that may have transited the application since deployment, and restrict the server's network egress to a minimal allowlist of upstream endpoints to shrink the MitM opportunity surface. Note that proxy-based mitigations do not protect against an attacker who controls the path between the proxy and the upstream service.