---
id: CVE-2026-48246
title: >-
  Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in
  ajax/reports.php
summary: >-
  Open ISES Tickets before 3.44.2 disables TLS certificate verification in
  ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting
  CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps
  Directions…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: Open ISES
product: Tickets
affected:
  - Tickets < 3.44.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-21T18:05:36.750571Z'
published: '2026-05-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:32.248Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-48246'
references:
  - url: 'https://github.com/openises/tickets/releases/tag/v3.44.2'
    label: Tickets 3.44.2 Release Notes
  - url: >-
      https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff
  - url: >-
      https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-ajax-reports-php
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.06308
ingestedAt: '2026-11-08T14:51:22.396Z'
---

## Overview

Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

## Affected

- `Tickets < 3.44.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.