Secuno
ENNL
Book demo

CVE-2026-44231

Bestpractical Request Tracker privilege escalation

9.1 CRITICALEPSS 0.41%
  1. Published20 Jul 2026

Description

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. This issue has been fixed in versions 5.0.10 and 6.0.3.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityLow
AvailabilityLow
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Affected products

Bestpractical Request Tracker≥ 6.0.0 < 6.0.3 · < 5.0.10

Remediation

Fixed in
Bestpractical Request Tracker≥ 6.0.3

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-163018.5
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before…
CVE-2026-938928.1
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated…
CVE-2026-821039.6
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker…
CVE-2026-1096678.8
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation…
CVE-2024-583908.8
Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management…
CVE-2026-1095598.7
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that…

Frequently asked

Is CVE-2026-44231 being actively exploited?

CVE-2026-44231 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.41%.

How severe is CVE-2026-44231?

CVE-2026-44231 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.41% probability of exploitation.

Which products are affected by CVE-2026-44231?

Affected products include Bestpractical Request Tracker.

How do I fix CVE-2026-44231?

Upgrade affected software to a fixed version, for example Bestpractical Request Tracker 6.0.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-44231 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.