CVE-2026-44231: RT Privilege Escalation Vulnerability

CVE-2026-44231 Overview

CVE-2026-44231 is an information disclosure and privilege escalation vulnerability in Request Tracker (RT), the open source enterprise-grade issue and ticket tracking system from Best Practical Solutions. The flaw resides in the REST 2.0 API and allows any authenticated non-administrative user to retrieve authentication credentials belonging to other users, including administrators. The disclosed credentials can then be used to read arbitrary data through RT's feed endpoints. The same request that leaks the credentials also rotates them, invalidating previously-distributed feed URLs across the entire instance. The issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is fixed in RT versions 5.0.10 and 6.0.3.

Critical Impact
A low-privilege authenticated user can escalate to administrator-equivalent read access and simultaneously break all existing feed URLs across the RT instance.

Affected Products

Request Tracker (RT) versions prior to 5.0.10
Request Tracker (RT) versions 6.0.0 through 6.0.2
RT REST 2.0 API and feed endpoints

Discovery Timeline

2026-07-20 - CVE-2026-44231 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-44231

Vulnerability Analysis

RT exposes a REST 2.0 API for programmatic access to tickets, users, and other objects. The API returns user records that include per-user authentication material used to sign RT's feed URLs, such as calendar feeds and search result feeds. Because the API enforces read access on user records at a level below administrative privilege, any authenticated user with basic API access can request another user's record and receive that user's feed authentication credentials.

An attacker holding a standard staff account can enumerate privileged accounts through the API, extract their credentials, and reissue feed requests as those users. This yields read access to tickets, queues, and search results that the attacker's own account cannot see. Because the disclosed material is used for signed feed URLs, the confidentiality impact extends across every object those higher-privileged users can read.

Root Cause

The root cause is missing authorization on a sensitive field within the REST 2.0 API response. The API returns feed credentials as part of the user object without restricting that field to the account owner or to administrators. This violates least-privilege access control on a secondary authentication secret.

Attack Vector

Exploitation requires network access to the RT web interface and a valid low-privilege account. The attacker issues an authenticated REST 2.0 API request against a targeted user record, parses the credential material from the response, and replays it against RT's feed endpoints to read data as the targeted user. As a side effect, the same request rotates the victim's credentials, which invalidates every previously-distributed feed URL for that user across the instance and provides a noticeable operational tell.

Refer to the GitHub Security Advisory GHSA-7rx2-x357-wv74 for the vendor's technical description.

Detection Methods for CVE-2026-44231

Indicators of Compromise

Unexpected REST 2.0 API requests from non-administrative accounts targeting other users' records, particularly administrator accounts.
Sudden helpdesk reports of broken calendar, iCal, or search feed URLs across many users, indicating mass credential rotation.
Feed endpoint access originating from IP addresses or user agents that do not match the account owner's normal usage.

Detection Strategies

Review RT web server access logs for GET requests to /REST/2.0/user/ paths issued by accounts that do not belong to administrators or automation.
Correlate REST 2.0 API user-lookup requests with subsequent feed endpoint requests from the same source using disclosed credentials.
Alert on any single session that reads multiple distinct user records through the REST 2.0 API within a short time window.

Monitoring Recommendations

Ship RT application and web server logs to a centralized log platform and retain them long enough to investigate historical access.
Baseline normal REST 2.0 API consumers and alert on new clients issuing user-object queries.
Monitor for spikes in feed URL regeneration or user complaints about invalidated feeds, which can indicate active exploitation.

How to Mitigate CVE-2026-44231

Immediate Actions Required

Upgrade RT to version 5.0.10 for the 5.x branch or 6.0.3 for the 6.x branch as published in the RT 6.0.3 release notes.
Audit REST 2.0 API access logs for anomalous reads of user records prior to patching.
Reset credentials and rotate feed URLs for any account suspected of exposure.

Patch Information

Best Practical Solutions has released fixed versions 5.0.10 and 6.0.3. Both patches restrict the REST 2.0 API so that feed authentication material is no longer returned to unauthorized callers. Administrators should upgrade to one of the fixed releases and then validate that REST 2.0 responses for user objects no longer contain feed credentials.

Workarounds

Restrict REST 2.0 API access at the web server or reverse proxy layer to trusted networks or specific service accounts until the patch is applied.
Temporarily revoke the RT rights that grant REST 2.0 API access to non-administrative users where operationally feasible.
Increase logging verbosity on the RT web tier to capture full request URIs and authenticated principals for incident review.

bash

# Example nginx snippet to restrict REST 2.0 access to an internal CIDR
location /REST/2.0/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://rt_backend;
}