Privilege escalation and information disclosure in RT REST 2.0 API (CVE-2026-44231)

An information disclosure and privilege escalation vulnerability exists in the REST 2.0 API of RT, an open source issue and ticket tracking system. A privileged but non-administrative user can obtain authentication credentials belonging to other users, including administrators, and use those credentials to access data via RT's feed endpoints. The same request that exposes credentials also rotates them, disrupting previously distributed feed URLs across the instance. Affected versions: - < 5.0.10 - >= 6.0.0, < 6.0.3 We recommend updating to: 5.0.10, 6.0.3. CVSS 9.1 · our assessment: act_now Reference: https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74 Details: https://vuln.today/cve/CVE-2026-44231