Request Tracker CVE-2026-44230

The victim must be an authenticated RT user with an active browser session at the time of exploitation - the CVSS PR:N metric reflects that the attacker requires no credentials of their own, not that the victim is unauthenticated. UI:R confirms that victim interaction (clicking or otherwise loading the crafted URL) is mandatory; the attack cannot proceed without this step. No special RT configuration, enabled features, or non-default deployment modes are described as prerequisites - the vulnerability affects the standard RT web interface across all affected versions. Exploitation is inherently limited by the requirement to socially engineer a specific class of user (active, authenticated RT operators), which prevents automated or opportunistic mass scanning exploitation. Deployments that restrict RT access to internal networks or VPN further raise the bar by limiting who can deliver the crafted URL.

The CVSS 6.1 score reflects a network-accessible (AV:N), low-complexity (AC:L) attack that requires no attacker privileges (PR:N) but mandates victim user interaction (UI:R). The Scope Changed (S:C) metric elevates the score above a typical Moderate-rated XSS, acknowledging browser context impact. No EPSS data was provided in source intelligence, so exploitation probability cannot be quantified from that signal. RT is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified - these are meaningful limiting signals. The practical risk is moderate: while an attacker can craft the malicious URL trivially and needs no credentials, successful exploitation requires a phishing or social engineering step to deliver the URL to an authenticated RT user. This reduces automatable and opportunistic mass exploitation risk significantly. The attack is not remotely exploitable without the victim's active participation. Organizations running internal-only RT deployments behind VPNs or access controls face materially lower exposure than those with internet-facing RT instances.

An attacker identifies a parameter in the RT web interface that is reflected unsanitized in the HTTP response, then constructs a URL embedding a JavaScript payload (e.g., a cookie-stealing script targeting the RT session token). The attacker delivers this URL to an RT user with an active authenticated session via a phishing email, internal chat message, or malicious redirect. When the victim clicks the link, their browser executes the injected script within the RT origin, potentially exfiltrating session cookies or performing privileged ticket operations on the victim's behalf. No public proof-of-concept code has been identified at time of analysis.