CVE-2026-48246 describes a vulnerability in Open ISES Tickets prior to version 3.44.2 where TLS certificate verification is disabled by setting CURLOPT_SSL_VERIFYPEER to false and not setting CURLOPT_SSL_VERIFYHOST in ajax/reports.php. This affects outbound HTTPS requests to the Google Maps Directions API used during incident report generation. An attacker positioned on the network path can exploit this to perform man-in-the-middle attacks by presenting forged certificates, enabling interception or modification of requests and responses including sensitive data in transit.

The vulnerability allows an attacker with network access between the server and the Google Maps API endpoint to intercept, monitor, or alter HTTPS requests and responses. This can lead to disclosure of API keys, session data, or manipulation of incident report data. The CVSS 4.0 score is 8.2 (high severity), reflecting the network attack vector and potential confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to trusted endpoints or implementing additional network-level protections to prevent man-in-the-middle attacks. Monitor vendor channels for updates regarding an official fix or patch.