CVE-2026-41074
RT has broken CSRF protection for authenticated users
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
3th
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.
| CWE | CWE-352 |
| Vendor | bestpractical |
| Product | rt |
| Published | May 22, 2026 |
| Last Updated | May 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for bestpractical rt
Be the first to know when new high vulnerabilities affecting bestpractical rt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
bestpractical / rt
>= 6.0.0, < 6.0.3