CVE-2026-44231

{
  "id": "CVE-2026-44231",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T20:16:43.797",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3."
    },
    {
      "lang": "es",
      "value": "RT es un sistema de seguimiento de incidencias y tickets de código abierto, de nivel empresarial. Las versiones anteriores a la 5.0.10, 6.0.0 y superiores, anteriores a la 6.0.3, contienen una vulnerabilidad de revelación de información y escalada de privilegios en la API REST 2.0. Un usuario privilegiado (no administrativo) puede obtener credenciales de autenticación pertenecientes a otros usuarios -incluidos usuarios con privilegios administrativos- y usar esas credenciales para leer datos como esos usuarios a través de los puntos finales de feed de RT. La misma solicitud que expone las credenciales también las rota, invalidando las URL de feed distribuidas previamente en toda la instancia. Este problema ha sido solucionado en las versiones 5.0.10 y 6.0.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "bestpractical",
          "product": "rt",
          "versions": [
            {
              "version": "< 5.0.10",
              "status": "affected"
            },
            {
              "version": ">= 6.0.0, < 6.0.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 5.3
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T12:46:02.396679Z",
          "id": "CVE-2026-44231",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.0.10",
              "matchCriteriaId": "F477C43C-C4EB-41F5-BB03-5BE23D43FD05"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bestpractical:request_tracker:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0.0",
              "versionEndExcluding": "6.0.3",
              "matchCriteriaId": "C106711D-0178-4681-BA2F-081792A36275"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bestpractical/rt/releases/tag/rt-6.0.3",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}