PT-2026-42524 · Unknown · Open Ises Tickets

Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-48246

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2

Description The software disables TLS certificate verification when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. This occurs in the 'ajax/reports.php' endpoint by setting the CURLOPT SSL VERIFYPEER variable to false and failing to set CURLOPT SSL VERIFYHOST. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data in transit.

Recommendations Update to version 3.44.2 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-48246

Affected Products

Open Ises Tickets

References · 5

• https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-48246 · Security Note
• https://github.com/openises/tickets/releases/tag/v3.44.2 · Note
• https://t.me/CVEtracker/54535 · Telegram Post
• https://vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-ajax-reports-php · Note