What is the CVSS score of CVE-2026-44231?

CVE-2026-44231 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L. EPSS exploitation probability: 0.4%.

Which versions of Request Tracker are affected by CVE-2026-44231?

Best Practical's Request Tracker versions 6.0.0-6.0.2 and earlier 5.x releases contain a critical privilege escalation flaw allowing authenticated privileged users to harvest and replay…. A patch is available.

How to fix or mitigate CVE-2026-44231?

Within 24 hours, audit your Request Tracker deployment to confirm version and verify whether it falls within the vulnerable ranges (6.0.0-6.0.2 or any 5.x version below 5.0.10). Within 7 days, upgrade to patched versions: Request Tracker 5.0.10 (for v5.x branch) or 6.0.3 (for v6.x branch). Within 30 days, execute full administrative credential rotation, audit REST API logs for the past 90 days to detect unauthorized harvest attempts, and regenerate all RSS and iCal feed URLs to restore integration functionality.

Request Tracker CVE-2026-44231

EUVD-2026-46079 CRITICAL

Information Exposure (CWE-200)

2026-07-20 GitHub_M

Privilege Escalation Information Disclosure Rt Bestpractical

9.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

vuln.today AI

9.1 CRITICAL

Network REST API (AV:N/AC:L) needs a privileged non-admin login (PR:L, no UI); crossing to admin identity is a scope change (S:C) with high credential disclosure (C:H) and low integrity/availability from token rotation.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 20, 2026 - 21:17 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 20:17 vuln.today

Analysis Generated

Jul 20, 2026 - 20:17 vuln.today

CVE Published

Jul 20, 2026 - 19:20 cve.org

CRITICAL 9.1

DescriptionCVE.org

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users - including users with administrative privileges - and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.

AnalysisAI

Privilege escalation and information disclosure in Best Practical's Request Tracker (RT) 6.0.0-6.0.2 and versions before 5.0.10 lets a privileged but non-administrative user harvest other users' authentication credentials - including those of administrators - through the REST 2.0 API and replay them against RT's RSS/iCal feed endpoints to read data as those victims. Because the same credential-exposing request also rotates the tokens, exploitation is destructive: it silently invalidates every previously distributed feed URL across the instance. No public exploit has been identified at time of analysis; the flaw is fixed in RT 5.0.10 and 6.0.3.

Technical ContextAI

RT is a Perl-based, enterprise-grade issue and ticket-tracking platform (CPE cpe:2.3:a:bestpractical:rt). The defect lives in the REST 2.0 API user collection endpoint, which over-exposes per-user secrets - specifically the authentication tokens RT issues for its RSS and iCal feed URLs (feeds are authenticated by an embedded per-user secret rather than an interactive login). Mapped to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the root cause is an authorization/output-filtering failure: the endpoint returns credential material to any privileged user regardless of whether they should be able to see other accounts' secrets, so a low-tier privileged user can read the feed token of a higher-tier user and then authenticate to feed endpoints as that user.

RemediationAI

Vendor-released patch: upgrade to RT 5.0.10 (5.x line) or RT 6.0.3 (6.x line), available from https://download.bestpractical.com/pub/rt/release/rt-6.0.3.tar.gz and documented at https://github.com/bestpractical/rt/releases/tag/rt-6.0.3 and advisory https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74. Note that RT 6.0.3 inadvertently omitted a separate TSV export header-injection fix (CVE-2026-41073); 6.0.3 operators should additionally apply commit 525547751b76cc422015960bae3056f4e8d4351f (to ship in 6.0.4). If immediate patching is not possible, compensating controls include restricting or disabling the REST 2.0 user collection endpoint at the web-server/reverse-proxy layer (trade-off: breaks automation and integrations that rely on REST 2.0), tightly limiting which users hold privileged (non-admin) rights that grant API access, and monitoring feed-endpoint access and unexpected feed-token rotations. Because exploitation rotates feed credentials, expect that legitimate RSS/iCal feed URLs may need to be reissued after the upgrade.