{"id":"CVE-2026-44231","summary":"RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint","details":"RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.","aliases":["GHSA-7rx2-x357-wv74"],"modified":"2026-07-25T03:32:03.115481512Z","published":"2026-07-20T19:20:43.950Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200","CWE-269","CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44231.json"},"references":[{"type":"WEB","url":"https://github.com/bestpractical/rt/releases/tag/rt-6.0.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44231.json"},{"type":"ADVISORY","url":"https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44231"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bestpractical/rt","events":[{"introduced":"0"},{"introduced":"84623aa0fd0dcc02d1821866d37ac824a902cec8"},{"fixed":"51f63bbd924b9277ec6d2db49a6d89e8f25da141"},{"fixed":"4a8ed900956527a8845f22a7ab011ec3225be91b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.0.10"},{"introduced":"6.0.0"},{"fixed":"6.0.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["rt-5.0.0beta1","rt-5.0.0alpha1","rt-4.6.0-pre1","rt-4.1.23","rt-4.1.19","rt-4.1.17","rt-4.1.13","rt-4.1.8","rt-4.1.7","rt-4.1.6","rt-4.1.5","rt-3.9.7","rt-3.9.6","rt-3.9.5","rt-3.9.4","rt-3.8.8rc1","rt-3.8.0rc1","rt-3.7.86","rt-3.7.85","rt-3.7.15","rt-3.7.1","rt-3.5.5","rt-3.5.4","rt-3.5.3","rt-3.5.2","rt-3.5.1","rt-3.3.4","rt-3.3.3","rt-3.3.2","rt-3.1.2","rt-3.0.8","rt-3.0.8rc1","rt-3.0.8pre2","rt-3.0.8pre1","rt-3.0.7_01","rt-3.0.7","rt-3.0.7rc1","rt-3.0.7pre3","rt-3.0.7pre2","rt-3.0.7pre1","rt-3.0.6","rt-3.0.6rc1","rt-3.0.5","rt-3.0.5rc1","rt-3.0.5pre6","rt-3.0.5pre5","rt-3.0.5pre4","rt-3.0.5pre3","rt-3.0.5pre2","rt-3.0.5pre1","rt-3.0.4","rt-3.0.4rc2","rt-3.0.4rc1","rt-3.0.4pre1","rt-3.0.3","rt-3.0.3rc4","rt-3.0.3rc3","rt-3.0.3rc2","rt-3.0.3rc1","rt-3.0.3pre5","rt-3.0.3pre4","rt-3.0.3pre3","rt-3.0.3pre2","rt-3.0.3pre1","rt-3.0.2","rt-3.0.2pre6","rt-3.0.2pre5","rt-3.0.2pre4","rt-3.0.2pre3","rt-3.0.2pre2","rt-3.0.2pre1","rt-3.0.1","rt-3.0.1pre2","rt-3.0.1pre1","rt-3.0.0","rt-3.0.0rc4","rt-3.0.0rc3","rt-3.0.0rc2","rt-3.0.0rc1","rt-3.0.0rc0","rt-2.1.88","rt-2.1.87","rt-2.1.87777777","rt-2.1.86","rt-2.1.85","rt-2.1.84","rt-2.1.83","rt-2.1.82","rt-2.1.81","rt-2.1.80","rt-2.1.79","rt-2.1.78","rt-2.1.77","rt-2.1.76","rt-2.1.75","rt-2.1.74","rt-2.1.73","rt-2.1.72","rt-2.1.71","rt-2.1.70","rt-2.1.69","rt-2.1.68","rt-2.1.67","rt-2.1.66","rt-2.1.64","rt-2.1.63","rt-2.1.62","rt-2.1.61","rt-2.1.60","rt-2.1.59","rt-2.1.58","rt-2.1.57","rt-2.1.56","rt-2.1.55","rt-2.1.54","rt-2.1.53","rt-2.1.52","rt-2.1.51","rt-2.1.50","rt-2.1.49","rt-2.1.48","rt-2.1.47","rt-2.1.46","rt-2.1.45","rt-2.1.44","rt-2.1.43","rt-2.1.42","rt-2.1.41","rt-2.1.39","rt-2.1.38","rt-2.1.37","rt-2.1.36","rt-2.1.35","rt-2.1.34","rt-2.1.33","rt-2.1.32","rt-2.1.31","rt-2.1.30","rt-2.1.29","rt-2.1.28","rt-2.1.27","rt-2.1.26","rt-2.1.25","rt-2.1.24","rt-2.1.23","rt-2.1.22","rt-2.1.21","rt-2.1.20","rt-2.1.19","rt-2.1.18","rt-2.1.17","rt-2.1.16","rt-2.1.15","rt-2.1.14","rt-2.1.13","rt-2.1.12","rt-2.1.11","rt-2.1.10","rt-2.1.9","rt-2.1.8","rt-2.1.7","rt-2.1.6","rt-2.1.5","rt-2.1.4","rt-2.1.3","rt-2.1.1","rt-2.0.12.pre3","rt-2.0.12.pre2","rt-2.0.12.pre1","rt-2.0.11","rt-2.0.11pre1","rt-2.0.10","rt-2.0.10.test4","rt-2.0.10.test3","rt-2.0.10.test2","rt-2.0.10.test1","rt-2.0.9","rt-2.0.9pre9","rt-2.0.9pre8","rt-2.0.9pre7","rt-2.0.9pre6","rt-2.0.9pre5","rt-2.0.9pre4","rt-2.0.9pre3","rt-2.0.8_01","rt-2.0.9pre1","rt-2.0.8","rt-2.0.8pre3","rt-2.0.8pre2","rt-2.0.8pre1","rt-2.0.7","rt-2.0.7pre1","rt-2.0.6","rt-2.0.6.pre7","rt-2.0.6.pre6","rt-2.0.6.pre5","rt-2.0.6.pre4","rt-2.0.6.pre3","rt-2.0.6.pre1","rt-2.0.5","rt-2.0.5.test3","rt-2.0.5.test2","rt-2.0.5.test1","rt-2.0.4","rt-2.0.3","rt-2.0.2","rt-2.0.2test3","rt-2.0.2test2","rt-2.0.2test1","rt-2.0.1","rt-2.0.1.test4","rt-2.0.1.test3","rt-2.0.1.test2","rt-2.0.1.test1","rt-2.0.0","rt-2.0.0.rc3","rt-2.0.0.rc2","rt-2.0.0.rc1","rt-1.3.106","rt-1.3.105","rt-1.3.104","rt-1.3.103","rt-1.3.103.private.pretest","rt-1.3.102","rt-1.3.101","rt-1.3.100","rt-1.3.99","rt-1.3.98","rt-1.3.97","rt-1.3.96","rt-1.3.95","rt-1.3.95.test2","rt-1.3.95.test1","rt-1.3.94","rt-1.3.93","rt-1.3.92","rt-1.3.91","rt-1.3.90","rt-1.3.89","rt-1.3.88","rt-1.3.87","rt-1.3.86","rt-1.3.85","rt-1.3.84","rt-1.3.83","rt-1.3.82","rt-1.3.81","rt-1.3.80","rt-1.3.79","rt-1.3.79.test1","rt-1.3.78","rt-1.3.77","rt-1.3.75","rt-1.3.74","rt-1.3.73","rt-1.3.72","rt-1.3.71","rt-1.3.70","rt-1.3.69","rt-1.3.68_02","rt-1.3.68_01","rt-1.3.68","rt-1.3.67","rt-1.3.66","rt-1.3.65","rt-1.3.64","rt-1.3.63","rt-1.3.62","rt-1.3.61","rt-1.3.60","rt-1.3.59","rt-1.3.58","rt-1.3.57","rt-1.3.56","rt-1.3.55","rt-1.3.54","rt-1.3.53","rt-1.3.52","rt-1.3.51","rt-1.3.50","rt-1.3.49_01","rt-1.3.49","rt-1.3.48","rt-1.3.47","rt-1.3.46","rt-1.3.45","rt-1.3.44","rt-1.3.43","rt-1.3.42","rt-1.3.41","rt-1.3.40","rt-1.3.39","rt-1.3.38","rt-1.3.37","rt-1.3.36","rt-1.3.35","rt-1.3.34","rt-1.3.33","rt-1.3.32","rt-1.3.31","rt-1.3.30","rt-1.3.29","rt-1.3.28","rt-1.3.27","rt-1.3.26","rt-1.3.25","rt-1.3.24","rt-1.3.23","rt-1.3.22","rt-1.3.21","rt-1.3.20","rt-1.3.19","rt-1.3.18","rt-1.3.17","rt-1.3.16","rt-1.3.15","rt-1.3.13","rt-1.3.12","rt-1.3.11","rt-1.3.10","rt-1.3.9","rt-1.3.8","rt-1.3.7","rt-1.3.6","rt-1.3.0","rt-1.1.10","rt-1.1.9","rt-1.1.8","rt-1.1.7","rt-1.1.6","rt-1.1.5","rt-1.1.4pre","rt-1.1.3broken","rt-1.1.1","rt-1.1.2","rt-1.pre1.2","rt-1.1pre.1","rt-0.99.8","rt-0.99.8pre9","rt-0.99.8pre8","rt-0.99.8pre5","rt-0.99.8pre4","rt-0.99.8pre3","rt-0.99.8pre2","rt-0.99.8pre1","rt-0.99.7","rt-0.99.6","rt-0.99.6pre6","rt-0.99.6pre5","rt-0.99.6pre4","rt-0.99.6pre1","rt-0.99.5","rt-0.99.5pre1","rt-0.99.4","rt-0.99.4pre1","rt-0.99.3","rt-0.99.2","rt-0.99.1","rt-0.9.20","rt-0.9.19","rt-0.9.18","rt-0.9.17","rt-0.9.16","rt-0.9.15","rt-0.9.14","rt-0.9.13","rt-0.9.12","rt-0.9.11","rt-0.9.10"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44231.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"}]}