Request Tracker CVE-2026-41074

Exploitation requires that a victim already holds a valid authenticated RT session in their browser and, during that session, is induced to load attacker-controlled HTML (phishing email, malicious link, compromised third-party site) - the CVSS UI:R flag captures this victim-interaction requirement. The attacker needs no RT account (PR:N) and no network position adjacent to the RT server, but is limited to actions the victim's account is authorized to perform, so impact scales with the victim's privilege level; targeting privileged or administrator accounts is necessary to reach high-integrity outcomes. Only RT versions 6.0.0-6.0.2 are vulnerable, and deployments where browsers enforce SameSite=Strict on the RT session cookie, or where a reverse proxy strips/validates Origin headers, materially limit reach.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L describes a network-reachable, low-complexity attack requiring no privileges on the RT server itself but requiring user interaction (UI:R) from a logged-in victim - a hallmark CSRF profile. PR:N reflects that the attacker needs no RT account, however the victim must already be authenticated to RT, which is a meaningful practical constraint that raw CVSS does not surface. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so real-world exploitation pressure appears low; the dominant risk is targeted spear-phishing of RT administrators where forced ticket modification, privilege changes, or queue tampering could damage workflow integrity. Integrity impact is rated High while confidentiality is None, consistent with CSRF's inability to directly read responses - defenders should treat this as a tampering/integrity risk rather than a data-exfiltration risk.

An attacker crafts a malicious web page or HTML email containing a hidden form or image tag that auto-submits a request to a state-changing RT endpoint (for example, modifying a ticket, granting rights, or changing a user profile). When an authenticated RT user - ideally an administrator - visits the page in the same browser session, RT executes the action under that user's identity. No public exploit identified at time of analysis, but CSRF payloads for similar Perl/Mason ticketing apps are trivial to construct.