The vulnerability CVE-2026-48247 affects Open ISES Tickets prior to version 3.44.2. It arises because the software disables TLS certificate verification in the incs/functions.inc.php file by setting CURLOPT_SSL_VERIFYPEER to false and not setting CURLOPT_SSL_VERIFYHOST when making outbound HTTPS requests. This improper validation enables a man-in-the-middle attacker on the network path to present a forged TLS certificate, which can lead to interception, monitoring, or modification of HTTPS traffic, including sensitive data such as API keys or session tokens. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality.

An attacker positioned on the network path can exploit this vulnerability to intercept or modify HTTPS requests and responses made by the affected Open ISES Tickets software. This includes the potential exposure of sensitive data such as API keys and session-bearing information transmitted in these requests. The impact is rated high due to the possibility of data compromise and session hijacking.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating the risk by restricting network access to trusted endpoints or using external network controls to prevent man-in-the-middle attacks. Avoid using affected versions in untrusted network environments.