Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M
CVE-2026-44231RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
Critical 9.1
In plain English
A critical-severity information exposure in rt from bestpractical. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | request-tracker4 | 4.4.6+dfsg-1.1+deb12u4 | DEBIAN-CVE-2026-44231 |
| Debian:12 | request-tracker5 | 5.0.3+dfsg-3~deb12u6 | DEBIAN-CVE-2026-44231 |
| Debian:13 | request-tracker5 | 5.0.7+dfsg-4+deb13u3 | DEBIAN-CVE-2026-44231 |
| Debian:14 | request-tracker5 | 5.0.10+dfsg-1 | DEBIAN-CVE-2026-44231 |
| Ubuntu:22.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2026-44231 |
| Ubuntu:24.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2026-44231 |
| Ubuntu:25.10 | request-tracker4 | no fix listed | UBUNTU-CVE-2026-44231 |
| Ubuntu:26.04:LTS | request-tracker4 | no fix listed | UBUNTU-CVE-2026-44231 |
| Ubuntu:25.10 | request-tracker5 | no fix listed | UBUNTU-CVE-2026-44231 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bestpractical | rt | < 5.0.10>= 6.0.0, < 6.0.3 |
Weakness: CWE-200, CWE-269, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
References
- https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74 x_refsource_CONFIRM
- https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 x_refsource_MISC