CVE-2026-44231
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Vulnerability in RT (Request Tracker) before versions 5.0.10 and 6.0.3 in the REST 2.0 API allows a privileged (non-admin) user to obtain credentials of other users, including admins, and use them to read data via feeds. The request rotates the credentials, invalidating existing feed URLs.
Risk Assessment
The organization is at risk of privilege escalation and data leakage, as a regular user can take over admin accounts and read all data in the ticket system.
Recommendation
Update RT to version 5.0.10 or 6.0.3. After updating, inform users to refresh their feed URLs.
Original NVD description (English source)
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.