CVE-2026-44231: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-44231 is a critical information disclosure and privilege escalation vulnerability in Best Practical's RT (Request Tracker), an open-source enterprise issue and ticket tracking system. The flaw resides in RT's REST 2.0 API user collection endpoint, allowing a privileged (non-administrative) user to obtain authentication credentials of other users — including administrators — and use those credentials to access data via RT's RSS/iCal feed endpoints. Affected versions are RT < 5.0.10 and RT >= 6.0.0, < 6.0.3. It was disclosed on May 20, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is rooted in incorrect authorization (CWE-863), improper privilege management (CWE-269), and exposure of sensitive information to unauthorized actors (CWE-200). A privileged but non-administrative RT user can send a crafted request to the REST 2.0 user collection endpoint, which improperly returns authentication credentials (feed tokens) belonging to other users, including administrators. A critical side effect is that the same request also rotates those credentials, invalidating any previously distributed feed URLs across the entire RT instance — causing a secondary availability impact. The attack requires network access and low-level privileges, with no user interaction needed (GitHub Advisory).

A successful exploit allows a privileged non-administrative user to harvest authentication credentials (feed tokens) for any RT user, including administrators, and then impersonate those users to read arbitrary data through RT's RSS and iCal feed endpoints. This results in high confidentiality impact (unauthorized access to potentially sensitive ticket and issue data), low integrity impact, and low availability impact (due to credential rotation invalidating existing feed URLs for all users). The scope change (S:C) in the CVSS vector reflects that the impact extends beyond the attacker's own account to affect other users' sessions and data across the instance (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify RT instances running versions prior to 5.0.10 or between 6.0.0 and 6.0.3 that expose the REST 2.0 API endpoint publicly or internally.
2. Authenticate as a privileged user: Log in to the RT instance using a valid non-administrative privileged account (e.g., an agent or staff-level account).
3. Query the REST 2.0 user collection endpoint: Send an authenticated HTTP GET request to the REST 2.0 users endpoint (e.g., /REST/2.0/users) to retrieve user records, which due to the authorization flaw, include feed authentication tokens/credentials for all users.
4. Extract credentials: Parse the API response to extract feed authentication tokens belonging to other users, including administrators.
5. Access feed endpoints as victim users: Use the harvested credentials to construct authenticated RSS or iCal feed URLs for target users (e.g., /NoAuth/rss/...?Token=<stolen_token>), gaining read access to their ticket data.
6. Note side effect: The credential-fetching request automatically rotates the exposed tokens, invalidating previously distributed feed URLs for all affected users across the instance (GitHub Advisory).

• Network: Unusual or repeated authenticated GET requests to the REST 2.0 user collection endpoint (e.g., /REST/2.0/users) from non-administrative user accounts, especially if querying all users or paginating through large result sets.
• Logs: RT access logs showing a privileged non-admin user account accessing /REST/2.0/users followed shortly by access to /NoAuth/rss/ or iCal feed endpoints using different user credentials or tokens.
• Logs: Sudden invalidation of feed URLs reported by multiple users (indicating credential rotation was triggered by an unauthorized request).
• Logs: Authentication events showing a single account accessing feed endpoints that belong to other users, particularly administrative accounts.

Users should upgrade RT to version 5.0.10 (for the 5.x branch) or 6.0.3 (for the 6.x branch) as soon as possible (GitHub Release). As a temporary workaround until patching is feasible, sites that do not actively use the REST 2.0 users endpoint or the RSS/iCal feed endpoints can block them at the web server level. For Apache 2.4+, add Require all denied directives to block the /REST/2.0/users and /NoAuth/rss/ and /NoAuth/ical/ paths. Additionally, administrators should review access logs for unauthorized credential disclosure and rotate all user authentication credentials, particularly for administrative accounts (GitHub Advisory).

The vulnerability was reported by security researcher Jeroen Gui and acknowledged by Best Practical in the official GitHub Security Advisory (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it high severity (Red Hat Bugzilla). Ubuntu issued a security notice (USN-8506-1) covering this and related RT vulnerabilities. The RT 6.0.3 release notes explicitly recommend all users upgrade as soon as possible due to this and several other security issues fixed in the same release (GitHub Release).