RT: Request Tracker

RT 6.0.4 Release Notes

RT 6.0.4 -- 2026-10-29
======================

RT 6.0.4 is now available for general use. This release addresses
many security issues and it is recommended that all users upgrade as
soon as possible. See below for details.

In addition to the security updates, this release includes many new
features and updates. The ticket Attachments widget and the ticket
and asset Links widgets are rebuilt with search, filtering, and new
ways to manage attachments and links. The lifecycle editor is updated,
and a new lifecycle viewer widget shows the available statuses and
lets users change status by clicking the graph. New authentication
features include TOTP multi-factor authentication, configurable
password policies, and self-service password reset. And there are many
more updates, improvements, and fixes.

https://download.bestpractical.com/pub/rt/release/rt-6.0.4.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-6.0.4.tar.gz.asc

SHA-256 sums

0db34899b0462e63c15d0cb23308deac1fe0b84104c65c1e528fedeb52fc33e3  rt-6.0.4.tar.gz
e178d015a3cb9fdb52dccdc82fa258efb9189a5119412f04ad272b6a52fbea47  rt-6.0.4.tar.gz.asc

Security

The following security issues are fixed in this release.

Thanks to CERT Polska for reporting the following findings.

* RT 6.0 is vulnerable to an authorization bypass in ticket forwarding.
A user with the ForwardMessage right on any ticket can email the
content and attachments of any transaction in RT, including on tickets
they cannot see, to an address of their choosing. This vulnerability is
assigned CVE-2026-108270.

* RT 6.0 is vulnerable to cross-site request forgery via the URL
shortener. A crafted short link followed by an administrator can make
rights changes as that administrator, including granting SuperUser.
This vulnerability is assigned CVE-2026-108279.

* RT 6.0 is vulnerable to information disclosure via RSS feed URLs. The
authentication string in a feed URL is not bound to its search, so
anyone with a feed URL can run any search with the rights of the feed
owner. This vulnerability is assigned CVE-2026-108278.

* RT 6.0 is vulnerable to unauthorized ticket modification and
disclosure via the CreateTickets scrip action. A user with queue-level
ModifyTemplate and ModifyScrips rights can create a Simple template
that creates or updates tickets in other queues. This vulnerability is
assigned CVE-2026-108275.

* RT 6.0 is vulnerable to privilege escalation via the REST group
endpoints. A user with AdminGroup on a user-defined group can convert
it into a role group, and a user with ModifyOwnMembership can add
themselves to role groups or the Privileged group. This vulnerability
is assigned CVE-2026-108353.

* RT 6.0 is vulnerable to code injection via article templates when
$DisallowExecuteCode is enabled. A user who can create or modify
articles can save Perl code that runs when the article is rendered.
Only instances that enable $EnableArticleTemplates are affected. This
vulnerability is assigned CVE-2026-108341.

* RT 6.0 is vulnerable to reflected cross-site scripting in the advanced
lifecycle editor. This vulnerability is assigned CVE-2026-108363.

* RT 6.0 is vulnerable to reflected cross-site scripting in the advanced
page layout editor. This vulnerability is assigned CVE-2026-108364.

* RT 6.0 is vulnerable to incorrect authorization of the destination
when moving dashboards, saved searches, articles, and REST 2.0 custom
field values, and when creating tickets via REST 2.0. Users could place
content into containers, classes, or objects they have no rights to.
This vulnerability is assigned CVE-2026-108271.

* RT 6.0 is vulnerable to forged cryptographic signature status in
incoming GnuPG and S/MIME mail. A sender can make RT display a
verified signature from someone else. This vulnerability is assigned
CVE-2026-108272.

* RT 6.0 is vulnerable to disclosure of ticket recipients on the ticket
People and Update pages to users with ReplyToTicket but not
ShowTicket. As a result of this fix, the web UI update forms now
require ShowTicket. This vulnerability is assigned CVE-2026-108273.

* RT 6.0 is vulnerable to information disclosure via the REST 1.0 group
endpoints, which did not check the SeeGroup right. This vulnerability is
assigned CVE-2026-108276.

* RT 6.0 is vulnerable to cross-site request forgery via
cookie-authenticated REST 2.0 requests. This vulnerability is assigned
CVE-2026-108277.

* RT 6.0 is vulnerable to missing object-level authorization on the
default values pages for queues, catalogs, and custom fields, and on
article class settings. Any user with ShowConfigTab can read and change
these settings. This vulnerability is assigned CVE-2026-108280.

* RT 6.0 is vulnerable to stored cross-site scripting via unvalidated
saved search options, such as the auto-refresh interval. This
vulnerability is assigned CVE-2026-108345.

* RT 6.0 is vulnerable to information disclosure via ticket relationship
graphs, which show the owner and custom field values of linked tickets
the user cannot see. This vulnerability is assigned CVE-2026-108347.

* RT 6.0 is vulnerable to cross-site request forgery in the Rights
Inspector, allowing forged revocation of rights grants. This
vulnerability is assigned CVE-2026-108365.

* RT 6.0 is vulnerable to cross-site request forgery on the search chart
page, allowing changes to a user's saved chart searches. This
vulnerability is assigned CVE-2026-108371.

* RT 6.0 is vulnerable to stored cross-site scripting via custom fields
configured to link to their own value with IncludeContentForValue or
LinkValueTo. This vulnerability is assigned CVE-2026-108343.

* RT 6.0 is vulnerable to login cross-site request forgery when
$RestrictLoginReferrer is enabled. This vulnerability is assigned
CVE-2026-108344.

* RT 6.0 is vulnerable to disclosure of hidden ticket time fields to
unprivileged users through Self Service export, REST 2.0, and search
when $HideTimeFieldsFromUnprivilegedUsers is enabled. This
vulnerability is assigned CVE-2026-108346.

Thanks to Jurre van Bergen and Threatnotify for reporting the following
findings.

* RT 6.0 is vulnerable to remote code execution via a bypass of the
ExecuteCode right. A user with ModifyTemplate but not ShowTemplate can
change the code in a Perl template. This also bypasses
$DisallowExecuteCode. This vulnerability is assigned CVE-2026-108351.

* RT 6.0 is vulnerable to an unauthenticated denial of service via
unbounded growth of the CSS cache. This vulnerability is assigned
CVE-2026-108349.

* RT 6.0 is vulnerable to missing authorization on the custom field and
custom role edit pages. A user with ShowConfigTab can remove the
applications of a custom field or custom role. This vulnerability is
assigned CVE-2026-108352.

* RT 6.0 is vulnerable to a signature trust check bypass in incoming
S/MIME mail, allowing improperly signed messages to be marked as
validly signed. This vulnerability is assigned CVE-2026-108350.

* RT 6.0 generates security tokens and password salts with a
non-cryptographic random number generator. These values are now
generated from the system's cryptographic random source. This
vulnerability is assigned CVE-2026-108348.

Thanks to CERT Polska, and to Jurre van Bergen and Threatnotify, for
reporting the following findings.

* RT 6.0 is vulnerable to an insecure direct object reference in custom
field values. Users can read, change, or delete custom field values on
objects they have no rights to. This vulnerability is assigned
CVE-2026-108274.

* RT 6.0 is vulnerable to multiple stored and reflected cross-site
scripting issues due to insufficient HTML escaping in areas including
HTML ticket descriptions, group and user names, Wikitext custom fields,
chart tables, ticket graphs, the article chooser, dashboard pages and
components, search result formats, and ticket history. This
vulnerability is assigned CVE-2026-108342.

* RT 6.0 is vulnerable to missing authorization on the scrip and custom
field admin pages. A user with ShowConfigTab can reorder scrips and
global custom fields and change the stage of global scrips. This
vulnerability is assigned CVE-2026-108281.

Thanks to Mateusz Szymaniec and CERT Polska for reporting the following
finding.

* RT 6.0 is vulnerable to stored cross-site scripting via URLs in HTML
ticket content. Links that RT creates automatically from URLs did not
escape the URL, so content from any sender, including unauthenticated
email to a public queue, can run script when the ticket is viewed. This
vulnerability is assigned CVE-2026-105454.

This release also includes the fix for spreadsheet injection via TSV
export headers that was missed in RT 6.0.3, completing the mitigation
for CVE-2026-41073.

Also included are updates to require newer versions of several
dependent Perl modules with security fixes: MIME::Tools 5.522,
HTML::Gumbo 0.19, Starlet 0.33, and Mozilla::CA 20261020.

Multi-Factor Authentication and Password Management

RT 6.0.4 adds several features to help secure user accounts:

* TOTP multi-factor authentication, which can be off, optional, or
  required for different groups of users.
* Configurable password policies, such as minimum length and required
  character classes.
* Password reset. RT::Extension::ResetPassword is now part of core RT,
  with self-service password reset available but disabled by default.

These features add a new $SecretKey configuration option. Set it before
users enroll in MFA. See docs/authentication.pod for details.

General user features

* Rebuild the ticket Attachments widget with search, filtering, and
  sorting, and allow users with ModifyTicket to add, delete, rename,
  and pin attachments, and to download, delete, or copy several
  attachments to a new ticket at once
* Rebuild the ticket and asset Links widget with inline edit, search,
  and filtering
* Support adding links to assets, articles, transactions, users,
  groups, and external URLs from the Links widget
* Add a transaction:// link type so transactions can be linked like
  other RT objects
* Limit the number of links shown on initial load, with a button to
  show more
* Add an optional default link type for new links
* Move ticket merge from the Links widget to the Actions menu
* Add a lifecycle viewer widget for tickets and assets that shows the
  statuses and transitions available to the current user
* Change ticket status by clicking a status in the lifecycle viewer
* Add Active and Inactive options to the search results Status filter
* Allow picking multiple assets in the ticket Assets box
* Accept typed or pasted input in autocomplete fields when leaving the
  field, rather than dropping it
* Default the SLA on the ticket update page to the ticket's current
  SLA rather than the queue default (thanks @arr2036!)
* Load recipients for Reply and Comment actions on dashboards
* Keep unchecked recipients unchecked on update pages without the
  PreviewScrips widget
* Apply article subject overrides on ticket create and update pages
* Run dashboard searches as each recipient when subscriptions are
  configured that way
* Fix the Time Worked report when queue autocomplete is enabled
* Fix numeric custom field chart functions for custom fields applied
  to specific queues (thanks elacour!)
* Fix empty custom role labels on asset bulk update
* Remove links to the deleted asset Modify page
* Always allow multiple Requestors and Ccs on the Self Service create
  page
* Align the Self Service article list with the article links portlet
  style
* Honor $AutocompleteOwners for the Owner input in the Basics widget
* Keep inline editors and dropdowns inside the browser window
* Dismiss tooltips on mouse leave after a right click
* Show the hover color, not the active color, on pressed dropdown items
* Make the full width of history and gear menu items clickable
* Shrink search and sort controls on mobile sized browsers
* Add aria-label to unlabelled checkboxes
* Reduce browser CPU use from the checkmark animation
* Fix the lifecycle status color picker background in dark mode
* Show text content of standalone multipart/related emails when
  PreferRichText is enabled
* Fix unmatched HTML tags when splitting stanzas at Outlook quote
  separators, which could cause duplicated ticket history on scroll
* Fix ticket search filters applied to queries with multiple top-level
  groups
* Style link buttons like input buttons in the dark theme
* Only show dashboards in a saved search's dependency list if the user
  can see them
* Fix searches for tickets with no unread messages on Oracle

Documentation

* Add a getting started page for new users
* Add authentication docs for password policy, password reset, and MFA
* Document the $DisableMFA config option
* Document the scheduled process run counter
* Note the Attachments and Links widget changes and faster ticket
  history search in UPGRADING-6.0
* Generate static doc filenames for bin and sbin like bin-rt.html to
  avoid case conflicts on case-insensitive file systems

Administration

* Convert the lifecycle editor to the Cytoscape library
* Add descriptions for statuses and transitions in the lifecycle
  editor, shown in the lifecycle viewer
* Show a pending changes message and save zoom settings in the
  lifecycle editor
* Add REST 2.0 endpoints for lifecycle information on tickets and
  assets
* Speed up searching a single ticket's history on MySQL and MariaDB
  when full text indexing is enabled
* Add $ProgressiveSearchResultRows to configure progressive loading of
  unpaginated search results
* Merge CustomFieldGroupings configurations from multiple config files
* Honor ShowScrips and ModifyScrips rights granted on a queue
* Preserve direct rights when migrating the 6.0.1 saved search and
  dashboard rights
* Restrict new page layout names to a simple character set and escape
  them in URLs
* Only accept dashboard and page layout widgets that the editor offered
* Generate dashboard email chart images with a one-shot Chromium
  process
* Keep CSS in dashboard emails when it is not inlined
* Use multipart/related for dashboard emails with chart images so more
  email clients show images inline
* Make the $EmailDashboardIncludeCharts default configurable at build
  time
* Skip disabled users correctly when building email digests
* Add standard --log option to rt-email-digest
* Increment the scheduled process run counter on success so weekly
  processes run on the configured schedule
* Don't count scheduled process runs that failed to start or were
  killed by a signal as successful
* Avoid "414 Request-URI Too Large" errors when saving large lifecycles
* Warn admins to set $SecretKey when MFA is enabled
* Warn about unknown date formats only when both date parsers fail
* Add the missing Code index for Shorteners
* Remove the unused $EditCustomFieldsSingleColumn option
* Remove font path support, as share/fonts no longer exists in RT 6
  (thanks andrew!)
* Honor version upper bounds for dependencies in "make fixdeps"
* Require DBIx::SearchBuilder 1.86
* Install README.md in the doc-install target (thanks andrew!)

Internals

* Sanitize attachment filenames, including Windows paths and control
  characters
* Store binary transaction OldValue and NewValue in ObjectContent
* Add PageLayoutHasWidget function
* Add a class for each field to collection table columns, so site CSS
  can target columns by field
* Delete deprecated code marked for deletion before version 6
* Register the dropzone htmx:load listener only once per page
* Calculate correct Content-Length for utf8 content in REST 2.0 comment
  and correspond responses (thanks @marek-veber!)
* Load shorteners by code case sensitively, improving performance on
  PostgreSQL and Oracle
* Find shortener codes of any length in LoadByContent, so deleting a
  saved search also removes its permanent shortener
* Only fix up S/MIME preambles that end with a bare CR, for
  compatibility with MIME::Tools 5.520
* Apply Atomic's cached rights only to the ticket it locked
* Require a valid class when changing an article's class
* Only allow attribute links between saved searches or the homepage and
  dashboards
* Do not alter the passed-in object in ProcessObjectCustomFieldUpdates
* Organize third-party libraries in directories with license copies
  and metadata files
* Generate the third-party README from library metadata
* Add a tool to check third-party libraries for CVEs and new versions

Testing

* Add tests for the Attachments and Links widgets, merge action, and
  RT::URI::transaction
* Add tests for lifecycle metadata, reachable transitions, layout, and
  REST 2.0 lifecycle endpoints
* Add tests for password reset, password policy, and TOTP MFA
* Add tests for dashboard emails and dashboard searches run as each
  recipient
* Add tests for DISTINCT searches with ORDER BY
* Add tests for single ticket history search on MySQL and MariaDB
* Add tests for scrip rights granted on a queue
* Add tests for page layout names and unknown dashboard and page layout
  widgets
* Add playwright tests for article subject override
* Add RT::Test::set_config helper for database-backed config changes
* Pass the Authorization header through Apache test configs
* Test variations of multipart/related email structures
* Test Content-Length in REST 2.0 responses with utf8 content
* Test loading shorteners by code and by content
* Test unmatched tags when splitting stanzas at Outlook quote
  separators
* Test rt-run-scheduled-processes, including runs killed by a signal
* Test lifecycle editor post-save redirect and error handling
* Test that the third-party README is up to date
* Update the mime_decoding test for MIME::Tools 5.521
* Add tests for attachment filename sanitizing
* Restore disabled database configs in test mode on refresh
* Update tests for Mojolicious 9.50
* Update to the latest test images


A complete changelog is available from git by running:
    git log rt-6.0.3..rt-6.0.4
or visiting
    https://github.com/bestpractical/rt/compare/rt-6.0.3...rt-6.0.4