EUVD-2026-46045Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requiring victim click (UI:R, PR:N); scope change (S:C) reflects browser context execution; C:L/I:L captures limited session and DOM impact with no server availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. There are no effective workarounds. Avoid following untrusted RT URLs. This issue has been fixed in version 6.0.3.
AnalysisAI
Reflected Cross-Site Scripting in RT (Request Tracker) 6.0.0 through 6.0.2 allows an unauthenticated network attacker to execute arbitrary JavaScript in an authenticated user's browser session by inducing that user to visit a crafted URL. The CVSS:3.1 scope-change flag (S:C) confirms the payload crosses from the RT application context into the victim's browser, enabling session token theft or unauthorized RT actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is RT 6.0.3, published 2026-05-20.
Technical ContextAI
RT (Request Tracker) is an open-source, enterprise-grade issue and ticket tracking system developed by Best Practical Solutions (CPE: cpe:2.3:a:bestpractical:rt:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled input - in this case, URL parameters - is incorporated into HTTP responses and rendered by the browser without adequate output encoding or sanitization. The 'reflected' variant means the payload is not persisted server-side; it must be delivered via a crafted link in each attack attempt. The CVSS scope change (S:C) is technically significant: it signals that successful exploitation extends impact beyond the RT web application security domain into the victim's browser context, which may include access to session cookies, local storage, and the ability to make authenticated requests to RT on the victim's behalf.
RemediationAI
Upgrade to RT 6.0.3, released 2026-05-20 and available at https://download.bestpractical.com/pub/rt/release/rt-6.0.3.tar.gz (SHA-256: 117b53e7a46e82ade662050d98920f1255865ca873d6bec80036085b17dd3dc6). The vendor security advisory is at https://github.com/bestpractical/rt/security/advisories/GHSA-7742-fhq7-ggv9 and the release tag is at https://github.com/bestpractical/rt/releases/tag/rt-6.0.3. The vendor explicitly states there are no effective workarounds for this vulnerability; the only vendor-endorsed mitigation is to avoid clicking untrusted RT URLs, which is a user-behavior control rather than a technical one. Separately, RT 6.0.3 users should also apply the out-of-band patch for CVE-2026-41073 (TSV export header injection, inadvertently omitted from 6.0.3) at https://github.com/bestpractical/rt/commit/525547751b76cc422015960bae3056f4e8d4351f.patch, which will be bundled into the forthcoming RT 6.0.4.
Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before
Authenticated SQL injection in Best Practical's Request Tracker (RT) ticketing system affects versions 5.0.0-5.0.9 and 6
Authentication bypass in Best Practical's Request Tracker (RT) versions 5.0.9 and prior, and 6.0.0 through 6.0.2, allows
Cross-site request forgery in Best Practical Request Tracker (RT) versions 6.0.0 through 6.0.2 allows remote attackers t
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback c
Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0
Reflected Cross-Site Scripting in Best Practical RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 allows an unauthenticated attac
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" perm
Stored XSS in Best Practical RT (versions 5.0.0-5.0.9 and 6.0.0-6.0.2) allows any authenticated user with file upload pe
Stored Cross-Site Scripting in Best Practical RT versions 6.0.0 through 6.0.2 allows an authenticated attacker with writ
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today