What is CVE-2026-48246?

CVE-2026-48246 is a medium-severity vulnerability in Open Ises Tickets, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2026-05-21.

How severe is CVE-2026-48246?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Open Ises Tickets

CVE-2026-48246

Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

Vulnerability class: Improper Certificate Validation

EPSS: 0.002 (6.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Open Ises Tickets — versions 0

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

disclosure@vulncheck.com (release-notes)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-48246?: CVE-2026-48246 is a medium-severity vulnerability in Open Ises Tickets, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2026-05-21.
How severe is CVE-2026-48246?: Medium severity. CVSS v3 base score is 5.9 out of 10.