Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN801 _____________________________________________________________________ DATE : 29/07/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running RT versions prior to 5.0.10, 6.0.3. ===================================================================== https://github.com/bestpractical/rt/security/advisories/GHSA-7rx2-x357-wv74 https://github.com/bestpractical/rt/security/advisories/GHSA-3w28-fmcr-mjjx https://github.com/bestpractical/rt/security/advisories/GHSA-7vf8-xv7w-97c6 https://github.com/bestpractical/rt/security/advisories/GHSA-265j-qx4w-256j https://github.com/bestpractical/rt/security/advisories/GHSA-p724-v26h-32g9 https://github.com/bestpractical/rt/security/advisories/GHSA-x576-pvwp-c2qv https://github.com/bestpractical/rt/security/advisories/GHSA-pfgp-5j8g-phgc https://github.com/bestpractical/rt/security/advisories/GHSA-7742-fhq7-ggv9 https://github.com/bestpractical/rt/security/advisories/GHSA-6x92-7v65-7m3r _____________________________________________________________________ Privilege escalation and information disclosure via REST 2.0 user collection endpoint Critical cbrandtbuffalo published GHSA-7rx2-x357-wv74 on May 20 Software rt Affected versions < 5.0.10, >= 6.0.0, < 6.0.3 Patched versions 5.0.10, 6.0.3 Description Impact An information disclosure and privilege escalation vulnerability exists in RT's REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credentials to read data as those users via RT's feed endpoints. The same request that exposes the credentials also rotates them, invalidating previously-distributed feed URLs across the instance. Patches Users should upgrade to RT 5.0.10 or 6.0.3. Workarounds Until the patch is applied, sites that do not actively use the REST 2.0 users endpoint or the RSS/iCal feed endpoints can block them at the web server level. For Apache: # Block REST 2.0 user collection Require all denied # Block RSS/iCal feed endpoints Require all denied Require all denied (Apache 2.4+; for 2.2, use Order deny,allow / Deny from all.) References OWASP: Broken Access Control Severity Critical 9.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed Confidentiality High Integrity Low Availability Low CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L CVE ID CVE-2026-44231 Weaknesses Weakness CWE-200 Weakness CWE-269 Weakness CWE-863 Credits @jeroengui jeroengui Finder _____________________________________________________________________ LDAP authentication bypass via empty password High cbrandtbuffalo published GHSA-3w28-fmcr-mjjx on May 20 Software rt Affected versions < 5.0.10, >= 6.0.0, < 6.0.3 Patched versions 5.0.10, 6.0.3 Description Impact An authentication bypass vulnerability exists in RT installations that use LDAP/AD for user authentication. Under certain LDAP server configurations, an attacker may be able to authenticate as any LDAP-backed RT user without supplying valid credentials. Patches Users should upgrade to RT 5.0.10 or 6.0.3. Workarounds Review your LDAP server's authentication policy to ensure it rejects unauthenticated bind attempts. Upgrading RT remains the recommended fix. References OWASP: Authentication Cheat Sheet Severity High 8.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE ID CVE-2026-41076 Weaknesses Weakness CWE-287 _____________________________________________________________________ SQL injection via entry_aggregator parameter in JSON search High cbrandtbuffalo published GHSA-7vfv7w-97c6 on May 20 Software rt Affected versions >= 5.0.0, < 5.0.10, >= 6.0.0, < 6.0.3 Patched versions 5.0.10, 6.0.3 Description Impact A SQL injection vulnerability exists in RT. An authenticated user can craft input that is incorporated into database queries without proper validation, potentially allowing them to read or modify data in the RT database. Patches Users should upgrade to RT 5.0.10 or 6.0.3. Workarounds Restrict RT account access to trusted users. References OWASP: SQL Injection Severity High 8.8/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged Confidentiality High Integrity High Availability High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE ID CVE-2026-41075 Weaknesses Weakness CWE-89 _____________________________________________________________________ CSRF protection broken for authenticated users in RT 6 High cbrandtbuffalo published GHSA-265j-qx4w-256j on May 20 Software rt Affected versions >= 6.0.0, < 6.0.3 Patched versions 6.0.3 Description Impact A Cross-Site Request Forgery (CSRF) vulnerability exists in RT 6. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. Patches Users should upgrade to RT 6.0.3. Workarounds No effective workarounds. Avoid visiting untrusted web pages while logged into RT. References OWASP: Cross-Site Request Forgery Severity High 7.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged Confidentiality None Integrity High Availability Low CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L CVE ID CVE-2026-41074 Weaknesses Weakness CWE-352 _____________________________________________________________________ Reflected Cross-Site Scripting in search results chart Moderate cbrandtbuffalo published GHSA-p724-v26h-32g9 on May 20 Software rt Affected versions >= 5.0.4, < 5.0.10, >= 6.0.0, < 6.0.3 Patched versions 5.0.10, 6.0.3 Description Impact A reflected Cross-Site Scripting (XSS) vulnerability exists in RT. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. Patches Users should upgrade to RT 5.0.10 or 6.0.3. Workarounds No effective workarounds. Avoid following untrusted RT URLs. References OWASP: Cross Site Scripting (XSS) Severity Moderate 6.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed Confidentiality Low Integrity Low Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE ID CVE-2026-44230 Weaknesses Weakness CWE-79 _____________________________________________________________________ Cross-Site Scripting via inline-served uploaded content Moderate cbrandtbuffalo published GHSA-x576-pvwp-c2qv on May 20 Software rt Affected versions >= 5.0.0, < 5.0.10, >= 6.0.0, < 6.0.3 Patched versions 5.0.10, 6.0.3 Description Impact A Cross-Site Scripting (XSS) vulnerability exists in RT where uploaded content is served inline rather than as an attachment. An authenticated user who can upload content can include JavaScript in the upload that will execute in the browser session of any RT user who later views or downloads it. Patches Users should upgrade to RT 5.0.10 or 6.0.3. Workarounds Restrict upload permissions to trusted users. Enable the AlwaysDownloadAttachments configuration option to force uploaded content to download rather than render inline. References OWASP: Cross Site Scripting (XSS) Severity Moderate 5.4/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed Confidentiality Low Integrity Low Availability None CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE ID CVE-2026-44229 Weaknesses Weakness CWE-79 _____________________________________________________________________ Stored Cross-Site Scripting via insufficient template escaping Moderate cbrandtbuffalo published GHSA-pfgp-5j8g-phgc on May 20 Software rt Affected versions >= 6.0.0, < 6.0.3 Patched versions 6.0.3 Description Impact A stored Cross-Site Scripting (XSS) vulnerability exists in RT 6 where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevant data can inject JavaScript that executes when another RT user views the affected page. Patches Users should upgrade to RT 6.0.3. Workarounds Restrict the ability to create or modify content to trusted users. References OWASP: Cross Site Scripting (XSS) Severity Moderate 5.4/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed Confidentiality Low Integrity Low Availability None CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE ID CVE-2026-44228 Weaknesses Weakness CWE-79 _____________________________________________________________________ Reflected Cross-Site Scripting via URL parameters Moderate cbrandtbuffalo published GHSA-7742-fhq7-ggv9 on May 20 Software rt Affected versions >= 6.0.0, < 6.0.3 Patched versions 6.0.3 Description Impact A reflected Cross-Site Scripting (XSS) vulnerability exists in RT 6. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. Patches Users should upgrade to RT 6.0.3. Workarounds No effective workarounds. Avoid following untrusted RT URLs. References OWASP: Cross Site Scripting (XSS) Severity Moderate 6.1/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed Confidentiality Low Integrity Low Availability None CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE ID CVE-2026-44227 Weaknesses Weakness CWE-79 _____________________________________________________________________ Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps Moderate cbrandtbuffalo published GHSA-6x92-7v65-7m3r on May 20 Software rt Affected versions < 5.0.10, >= 6.0.0, < 6.0.3 Patched versions 5.0.10, 6.0.3 Description Impact A spreadsheet (CSV/formula) injection vulnerability exists in RT. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. Patches Users should upgrade to RT 5.0.10 or 6.0.3. Workarounds Avoid opening exported RT spreadsheet files directly in spreadsheet applications if the data may contain untrusted user input. References OWASP: CSV Injection Severity Moderate 4.6/ 10 CVSS v3 base metrics Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Unchanged Confidentiality Low Integrity Low Availability None CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVE ID CVE-2026-41073 Weaknesses Weakness CWE-1236 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================