Security readout for executives and security teams
Plain-English summary
Open ISES Tickets before 3.44.2 exposed a Google Maps API key in publicly accessible source code. Anyone obtaining the key could charge Google Maps requests to the owner’s cloud project, potentially causing unexpected costs or consuming service quotas. The reported impact concerns credential and billing abuse, not compromise of ticket data or systems.
Executive priority
Address promptly where affected versions or the exposed key are present. The likely business risk is unauthorized cloud spending and quota exhaustion rather than direct system takeover. Prioritize key revocation and billing review because upgrading alone cannot make a previously published credential secret again.
Technical view
CVE-2026-48244 is a CWE-798 hardcoded-credential flaw in settings.inc.php. The embedded Google Maps API key was committed to the public repository and required no privileges or user interaction to obtain. It carries CVSS 4.0 score 6.9. Release 3.44.2 and its associated patch remove the exposed credential.
Likely exposure
Organizations using Open ISES Tickets before 3.44.2 should assume the bundled key is publicly known. Exposure primarily affects the Google Cloud project owning that key. The supplied sources do not establish that each deployment used a unique key or identify the number of exposed installations.
Exploitation context
The key could be reused for Google Maps Platform requests billed to its owner. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation. Public repository exposure nevertheless makes discovery inexpensive and does not require access to a deployed application.
Researcher notes
The public record supports unauthenticated disclosure of a hardcoded Google Maps API key and removal in 3.44.2. It does not document observed abuse, financial losses, key permissions, request restrictions, or secondary compromise. Validate exposure through version, source, credential status, and cloud telemetry without attempting unauthorized use of the key.
Mitigation direction
- Upgrade Open ISES Tickets to version 3.44.2 or later.
- Revoke or rotate the exposed Google Maps API key in the owning Google Cloud project.
- Review vendor release notes and patch details for deployment-specific guidance.
- Apply appropriate API restrictions and billing alerts when issuing any replacement key.
Validation and detection
- Confirm the installed Open ISES Tickets version is 3.44.2 or later.
- Verify settings.inc.php no longer contains the disclosed Google Maps API key.
- Confirm the exposed key has been revoked or disabled in Google Cloud.
- Review Google Maps usage and billing records for unexpected requests or charges.
- Check repository history, build artifacts, backups, and deployment bundles for retained copies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-798: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-48244 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4VulnCheckVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openises/tickets/releases/tag/v3.44.2CVE reference, VulnCheck · release-notes
- https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbffCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-google-maps-api-key-in-settings-inc-phpCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Hard-coded Credentials
Use of Hard-coded Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.