If you believe you've discovered a security issue in RT, please send an
email to security@bestpractical.com with a detailed description of the
issue, and a secure means to respond to you (such as your PGP public
key). You can find our PGP key and fingerprint at
https://bestpractical.com/security/.
Repository navigation
Security: bestpractical/rt
Security
SECURITY.md
-
Reflected Cross-Site Scripting in the advanced page layout editorGHSA-cgvr-24rj-9hmm published
Oct 29, 2026 by cbrandtbuffaloHigh -
Cross-Site Request Forgery in the Rights Inspector allows forged revocation of rights grantsGHSA-j8v2-hpvx-g7p9 published
Oct 29, 2026 by cbrandtbuffaloModerate -
Missing authorization in custom field and custom role editing pages removes their applicationsGHSA-g929-4mw8-qf3w published
Oct 29, 2026 by cbrandtbuffaloHigh -
Remote code execution via ExecuteCode right bypass in template administrationGHSA-8736-c225-x3g4 published
Oct 29, 2026 by cbrandtbuffaloHigh -
Cryptographic signature trust check bypass in incoming S/MIME mailGHSA-9qpg-4cg7-82vf published
Oct 29, 2026 by cbrandtbuffaloModerate -
Unauthenticated denial of service via unbounded CSS cache growthGHSA-4qwx-vvpp-rw2g published
Oct 29, 2026 by cbrandtbuffaloHigh -
Security tokens and password salts generated with a non-cryptographic PRNGGHSA-xrx9-5hcg-ccjg published
Oct 29, 2026 by cbrandtbuffaloLow -
Information disclosure via missing visibility checks in ticket relationship graphsGHSA-68hf-xgf4-ch3p published
Oct 29, 2026 by cbrandtbuffaloModerate -
Disclosure of hidden ticket time fields via Self Service export, REST 2.0 API, and searchGHSA-899w-w754-vj2h published
Oct 29, 2026 by cbrandtbuffaloLow -
Stored Cross-Site Scripting via unvalidated saved search optionsGHSA-vmcq-m6qj-4r22 published
Oct 29, 2026 by cbrandtbuffaloModerate
Learn more about advisories related to bestpractical/rt in the GitHub Advisory Database