PT-2026-42522 · Unknown · Open Ises Tickets

CVE-2026-48244 · Published 2026-05-21 · Updated 2026-05-21

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2

Description The software embeds a hardcoded Google Maps API key within the settings.inc.php file, which is committed to the public source repository. This allows individuals with read access to the source code to extract the key and perform Google Maps Platform requests that are billed to the original owner's Google Cloud project.

Recommendations Update to version 3.44.2 or later.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-48244

Affected Products

Open Ises Tickets

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48244.json · Exploit
• https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-48244 · Security Note
• https://osv.dev/vulnerability/CVE-2026-48244 · Vendor Advisory
• https://github.com/openises/tickets/releases/tag/v3.44.2 · Note
• https://vulncheck.com/advisories/open-ises-tickets-hardcoded-google-maps-api-key-in-settings-inc-php · Note
• https://t.me/CVEtracker/54533 · Telegram Post