CVE-2026-44231 in Best Practical
Summary
by MITRE • 07/20/2026
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability resides within the REST 2.0 API of RT, an open source enterprise-grade issue and ticket tracking system that has been widely adopted across organizations for managing support tickets and workflow processes. This security flaw affects multiple version ranges including those prior to 5.0.10, 6.0.0, and versions before 6.0.3, creating a persistent risk for deployments that have not been updated. The vulnerability manifests as an information disclosure and privilege escalation issue that fundamentally compromises the authentication integrity of the system.
The technical flaw operates through a specific mechanism where authenticated users with non-administrative privileges can exploit the feed endpoints to extract authentication credentials belonging to other users within the system. This includes credentials of users possessing administrative privileges, which creates a severe escalation path for threat actors who may gain initial access through less privileged accounts. The vulnerability's exploitation process is particularly dangerous because it not only exposes sensitive credentials but simultaneously rotates them, invalidating previously distributed feed URLs throughout the entire instance and disrupting legitimate user access patterns.
The operational impact of this vulnerability extends beyond simple credential theft to include complete disruption of the system's feed-based functionality and potential unauthorized data access. When a malicious user exploits this vulnerability, they can read data as other users, potentially accessing sensitive information, confidential tickets, or administrative functions that should remain restricted. The credential rotation aspect creates additional operational challenges as it invalidates existing feed URLs, requiring administrators to reconfigure and redistribute access tokens across their deployment while also addressing the compromised authentication state.
This vulnerability aligns with common weakness enumerations such as CWE-287, which addresses authentication bypass issues, and CWE-312, concerning exposure of sensitive information through partial disclosure. From an attack framework perspective, this issue maps to ATT&CK techniques including T1078 for valid accounts usage and T1566 for credential access through application weaknesses. The vulnerability's persistence across multiple version lines indicates a fundamental flaw in the API's authentication handling that required significant remediation efforts. Organizations should prioritize immediate patching of affected versions, implement monitoring for unauthorized feed endpoint access patterns, and conduct comprehensive credential rotation procedures to address potential compromise. The fix implemented in versions 5.0.10 and 6.0.3 demonstrates proper remediation through enhanced authentication checks and secure credential handling mechanisms that prevent the exposure and subsequent rotation of user credentials through API endpoints.