CVE-2026-41074
published 2026-05-22CVE-2026-41074: RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF)…
PriorityP432high7.1CVSS 3.1
AVNACLPRNUIRSUCNIHAL
EPSS
0.12%
1.9th percentile
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bestpractical | rt | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
cvelistv5v3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
bestpractical rt up to 6.0.2 cross-site request forgery (GHSA-265j-qx4w-256j)
vuldb·2026-05-23
CVE-2026-41074 [LOW] bestpractical rt up to 6.0.2 cross-site request forgery (GHSA-265j-qx4w-256j)
A vulnerability identified as problematic has been detected in bestpractical rt up to 6.0.2. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery.
This vulnerability was named CVE-2026-41074. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
CVEList
RT has broken CSRF protection for authenticated users
cvelistv5·2026-05-22·CVSS 7.1
CVE-2026-41074 [HIGH] CWE-352 RT has broken CSRF protection for authenticated users
RT has broken CSRF protection for authenticated users
RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 through 6.0.2 contain a Cross-Site Request Forgery (CSRF) vulnerability. An attacker who can induce a logged-in RT user to visit a malicious web page can trigger arbitrary state-changing actions in RT on that user's behalf. This issue has been fixed in version 6.0.3.
No detection rules found.
No public exploits indexed.
2026-05-22
Published