Request Tracker CVE-2026-44228

Exploitation requires three concurrent conditions: (1) the attacker holds a valid, authenticated RT account (PR:L per CVSS - unauthenticated access is not sufficient); (2) that account has permission to set the specific data field(s) affected by the missing HTML escaping; and (3) a separate victim user must actively navigate to and view the page where the injected payload is rendered (UI:R per CVSS - passive exploitation without victim interaction is not possible). The vulnerability is scoped to RT versions 6.0.0-6.0.2 only; earlier branches are not implicated by available data. There is no indication the vulnerability is exploitable without a pre-existing RT account, nor that it affects default read-only roles. The primary limiting factor is the authenticated, permissioned write access requirement.

The CVSS 5.4 Medium score is well-calibrated for this vulnerability. The network-accessible vector (AV:N/AC:L) reflects that exploitation requires no special network position beyond reaching the RT web interface, but PR:L and UI:R meaningfully constrain real-world risk - an attacker must hold a valid RT account with write permissions to the relevant data field, and a separate victim must actively view the affected page. The scope change (S:C) prevents under-rating this as purely a self-XSS. No EPSS data was provided in the intelligence; KEV listing is absent, indicating no confirmed active exploitation at time of analysis, and no POC is referenced. In practice, the primary concern is insider threat or compromised low-privilege RT accounts being leveraged to escalate impact by targeting administrators who review ticket data. The risk is real but bounded by the authentication prerequisite.

An authenticated RT user - such as a help-desk agent with ticket-creation rights - crafts a ticket or data entry containing an embedded JavaScript payload in a field that lacks HTML escaping (e.g., a subject, custom field, or comment). The payload is stored in the RT database. When an RT administrator or senior user opens the affected ticket to review or resolve it, the script silently executes in their browser, potentially exfiltrating their session token to an attacker-controlled endpoint or performing privileged RT actions on their behalf. No POC is referenced in the available intelligence.