Request Tracker CVE-2026-6841

The vulnerable 'Page' GET parameter is present in the RT web interface in its default configuration across all affected versions - no special server-side feature enablement is required. The attacker needs no authentication or privileges to construct the malicious URL. However, the following conditions limit exploitation: (1) the victim must click or load the attacker-crafted URL (user interaction is mandatory per CVSS UI:A - passive scanning cannot trigger this); (2) meaningful impact (e.g., session hijacking) requires the victim to hold an active authenticated RT session at the time of exploitation; (3) the attack is reflected (non-persistent), meaning the payload is not stored server-side and a new crafted URL must be delivered for each victim. No special RT configuration, plugin, or deployment mode is required - default installations on affected versions are vulnerable upon user interaction.

The CVSS 4.0 score of 5.1 (Medium) reflects network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), but mandatory user interaction (UI:A). The impact metrics show no direct vulnerable-system confidentiality or integrity loss (VC:N/VI:N/VA:N) and only low subsequent-system impact (SC:L/SI:L), consistent with reflected XSS where damage occurs in the victim's browser rather than the server. EPSS at 0.07% (22nd percentile) signals negligible current exploitation probability in the broader threat landscape. SSVC explicitly rates exploitation as 'none' with no known active or public exploitation, but flags the attack as 'automatable' - a threat actor can programmatically generate and distribute crafted URLs at scale with minimal effort. CISA KEV listing is absent. Taken together, this is a credible but moderate-priority vulnerability: the UI:A dependency eliminates opportunistic scanning-style exploitation, but phishing campaigns targeting RT-authenticated staff (helpdesk, sysadmin) could yield session hijacking or credential theft. The risk is elevated in environments where RT is exposed to the internet without additional access controls.

An attacker identifies an organization running a vulnerable RT instance exposed to the internet and crafts a GET request URL embedding a JavaScript payload in the 'Page' parameter (e.g., a cookie-stealing or CSRF-triggering script). The attacker sends the link to a helpdesk technician or sysadmin via a phishing email appearing to be a ticket notification. When the target clicks the link while holding an active RT session, the injected script executes in their browser, potentially exfiltrating the session cookie to an attacker-controlled endpoint and granting full authenticated access to the RT instance. No public proof-of-concept code has been identified, but the attack is trivial to construct given the reflective nature of the flaw.