---
id: CVE-2026-44231
title: 'RT is an open source, enterprise-grade issue and ticket tracking system'
summary: >-
  RT is an open source, enterprise-grade issue and ticket tracking system.
  Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an
  information disclosure and privilege escalation vulnerability in the REST 2.0
  API. A privileged…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L'
cwe:
  - CWE-200
  - CWE-269
  - CWE-863
vendor: bestpractical
product: request_tracker
affected:
  - request_tracker < 5.0.10
  - 'request_tracker >= 6.0.0, < 6.0.3'
patched:
  - request_tracker 6.0.3
published: '2026-07-20'
updated: '2026-08-07'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44231'
references:
  - url: 'https://github.com/bestpractical/rt/releases/tag/rt-6.0.3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00411
epssPercentile: 0.35106
ingestedAt: '2026-08-07T22:17:38.228Z'
---

## Overview

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.

## Affected

- `request_tracker < 5.0.10`
- `request_tracker >= 6.0.0, < 6.0.3`

## Remediation

Upgrade past the affected range:

- `request_tracker 6.0.3`