Request Tracker EUVD-2026-46079

Requires an authenticated RT account with privileged (non-administrative) rights sufficient to call the REST 2.0 user collection endpoint (CVSS PR:L) - it is not exploitable by anonymous or unauthenticated users. The attacker targets the REST 2.0 API to read other users' feed authentication credentials, then must use RT's RSS or iCal feed endpoints to act on the stolen tokens. Limiting factors: a valid privileged login is mandatory, the affected feature is the REST 2.0 API plus feed endpoints (deployments that disable REST 2.0 or feeds reduce exposure), and only RT versions <5.0.10 and 6.0.0-6.0.2 are affected. A notable side effect that also limits stealth: the credential-reading request rotates the victim's token, breaking their existing feed URLs and potentially tipping off defenders.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, base 9.1 Critical) is internally consistent with the description: network-reachable API, low complexity, requires an authenticated privileged (PR:L) but non-admin account, no user interaction, and a scope change (S:C) because a lower-privileged actor crosses a trust boundary to act as administrators - a textbook privilege-escalation signal. Confidentiality is High (admin credential/data disclosure); Integrity and Availability are Low, reflecting the token rotation that mutates state and breaks existing feed URLs. No EPSS score, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified from the input; the practical barrier is that an attacker must already hold a valid privileged RT account, which makes this primarily an insider or post-compromise escalation risk rather than an internet-wide unauthenticated threat. That authentication precondition tempers the Critical rating in practice, but the payoff (impersonating administrators) makes it a genuine priority to patch.

A disgruntled help-desk agent who holds a privileged (non-administrative) RT account queries the REST 2.0 user collection endpoint and reads back the feed authentication token belonging to an administrator. They paste that token into an RSS/iCal feed URL and pull tickets and data visible to the admin, exfiltrating sensitive content; the same call rotates the admin's token, breaking that user's existing feed subscriptions. No public POC was provided, and the low attack complexity means a knowledgeable insider could perform this with routine API calls.