CVE-2026-44231: RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint
Last updated 6 July 2026
Other sources
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/request-tracker4to a version that resolves this vulnerability.Fixed in 4.4.6+dfsg-1.1+deb12u4 - Upgrade
Upgrade
debian/request-tracker5to a version that resolves this vulnerability.Fixed in 5.0.3+dfsg-3~deb12u6Fixed in 5.0.7+dfsg-4+deb13u3Fixed in 5.0.10+dfsg-3 - Upgrade
Upgrade
RT (Request Tracker)to a version that resolves this vulnerability.Fixed in 5.0.10 - Upgrade
Upgrade
RT (Request Tracker)to a version that resolves this vulnerability.Fixed in 6.0.3 - Operational
After upgrading, invalidate any previously distributed RT REST 2.0 feed URLs across the instance because the affected request that exposed credentials also rotated them, rendering earlier feed URLs invalid.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44231?
The severity of CVE-2026-44231 is critical with a score of 9.1.
What systems are affected by CVE-2026-44231?
CVE-2026-44231 affects versions prior to 5.0.10 and 6.0.0 and above prior to 6.0.3 of the RT software.
How do I fix CVE-2026-44231?
To fix CVE-2026-44231, upgrade to versions 5.0.10 or 6.0.3 or later of the RT software.
What type of vulnerability is CVE-2026-44231?
CVE-2026-44231 is a privilege escalation and information disclosure vulnerability.
Who can exploit CVE-2026-44231?
CVE-2026-44231 can be exploited by a privileged (non-administrative) user to gain unauthorized access.