# CVE-2026-41074: Best Practical RT Cross-Site Request Forgery

Source: https://junglewise.ai/threats/cve-2026-41074-best-practical-rt-cross-site-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-41074 · Severity: high · CVSS 7.1 · Published 2026-05-22

Best Practical RT, an enterprise-grade ticket tracking system, contains a vulnerability that could allow an attacker to perform actions as a legitimate user. By tricking a logged-in staff member or administrator into visiting a malicious website, an attacker can silently trigger changes within the tracking system, such as modifying tickets or changing settings. This could lead to unauthorized data modification or disruption of support operations.

Technologies: [Best Practical Solutions Request Tracker](https://junglewise.ai/threats/technologies/request-tracker). Vendors: [Best Practical Solutions](https://junglewise.ai/threats/vendors/best-practical-solutions).

## Quick answers

**Is CVE-2026-41074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41074 being exploited in the wild.

**How severe is CVE-2026-41074?** High severity, with a CVSS score of 7.1, published 22 May 2026.

**Which products and versions are affected?** Best Practical Solutions Request Tracker 6.0.0 through 6.0.2.

**Is there a fix for CVE-2026-41074?** A patch was published on 2026-05-20: RT version 6.0.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41074 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41074?** Check whether you run Best Practical Solutions Request Tracker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in RT 6.0.0 through 6.0.2 due to insufficient verification of whether requests were intentionally initiated by the authenticated user. An attacker can exploit this by hosting a malicious web page and inducing a logged-in RT user to visit it (User Interaction required). Successful exploitation allows the attacker to execute arbitrary state-changing actions, such as modifying ticket data or system configurations, with the privileges of the victim user. The vulnerability is addressed in version 6.0.3.

## Affected products

- Best Practical RT (Request Tracker) 6.0.0 through 6.0.2

## Timeline

- 2026-05-20: patched: RT version 6.0.3 released
- 2026-05-20: advisory: GitHub Security Advisory GHSA-265j-qx4w-256j published
- 2026-05-22: disclosed: CVE-2026-41074 published to NVD

## References

- [https://github.com/bestpractical/rt/releases/tag/rt-6.0.3](https://github.com/bestpractical/rt/releases/tag/rt-6.0.3)
- [https://github.com/bestpractical/rt/security/advisories/GHSA-265j-qx4w-256j](https://github.com/bestpractical/rt/security/advisories/GHSA-265j-qx4w-256j)

## Related threats

- [Request Tracker stored XSS via unescaped URL in automatic links](https://junglewise.ai/threats/cve-2026-105454-rt-s-automatic-link-creation-for-urls-in-html-ticket-content)
- [Best Practical RT privilege escalation in REST 2.0 API](https://junglewise.ai/threats/cve-2026-44231-best-practical-rt-privilege-escalation-in-rest-2-0-api)
- [Best Practical RT stored XSS via inline uploaded content](https://junglewise.ai/threats/cve-2026-44229-best-practical-rt-stored-xss-via-inline-uploaded-content)
- [Best Practical RT SQL injection in JSON search entry_aggregator](https://junglewise.ai/threats/cve-2026-41075-best-practical-rt-sql-injection-in-json-search-entry-aggregator)
- [Best Practical Request Tracker reflected XSS in Page parameter](https://junglewise.ai/threats/cve-2026-6841-best-practical-request-tracker-reflected-xss-in-page-parameter)