CVE-2026-44231

Name of the Vulnerable Software and Affected Versions RT versions prior to 5.0.10 RT versions 6.0.0 through 6.0.2

Description An information disclosure and privilege escalation issue exists in the REST 2.0 API. A privileged user without administrative rights can obtain authentication credentials of other users, including administrators. These credentials allow the attacker to read data through feed endpoints. The request used to expose these credentials also triggers a rotation, which invalidates all previously distributed feed URLs across the instance.

Recommendations Update to version 5.0.10. Update to version 6.0.3.