LoginSign Up
← Back to all sparks
R

Request Tracker

SUPPORT
Velocity5.0

Enterprise-grade issue tracking and ticketing system for support desks

bestpractical.com/request-tracker ↗

RT's October pair fixes at least 27 CVEs and finally adds TOTP MFA to 5.0 and 6.0.

ticketingsecurity-releasescvemfamulti-branchself-hosting
◆Current state
Best Practical released RT 6.0.4 and 5.0.11 on 2026-10-29 as a coordinated security pair, with findings from CERT Polska. The notes list at least 27 CVEs, including a ticket-forwarding bypass that could email transactions from tickets the user cannot see, CSRF through the URL shortener that could grant SuperUser, and feed URLs that ran any search with the owner's rights. Both releases also add TOTP multi-factor authentication, configurable password policies and self-service password reset; 6.0.4 additionally rebuilds the attachments and links widgets and adds a lifecycle viewer.
◆Where it's heading
Security still sets RT's calendar: the May pair and the October pair both landed on one day across branches. What changed is that authentication features now ship on 5.0 as well as 6.0, rather than feature work staying on 6.0 only. The 4.4 branch had its final release in October 2025, so the active lines are now 5.0 and 6.0.
◆Prediction
The next release is likely another same-day 5.0 and 6.0 pair driven by security reports; the size of this batch suggests follow-up fixes could come sooner than the usual gap of several months.

◆Recent moves

  1. 15d ago

    RT 6.0.4 fixes dozens of CVEs and adds TOTP MFA

    6.0.4 fixes at least 27 CVEs reported by CERT Polska, among them CSRF via the URL shortener that could grant SuperUser and REST group endpoints open to privilege escalation. It also adds TOTP MFA, password policies and self-service reset, and rebuilds the attachments and links widgets.

    View source ↗
  2. 15d ago

    RT 5.0.11 fixes dozens of CVEs and adds TOTP MFA

    The 5.0 half of the 2026-10-29 pair carries the same security batch and, unusually for this branch, new features: TOTP MFA, password policies and self-service password reset. Authentication hardening is the one area where 5.0 keeps pace with 6.0.

    View source ↗
  3. 5mo ago

    Security release fixes REST 2.0 credential leak and SQL injection

    The 5.0 half of a same-day security pair with 6.0.3, fixing a REST 2.0 endpoint that exposed and rotated other users' feed credentials, SQL injection in JSON search, and an LDAP authentication bypass. The one non-security change is inline CSS handling in ticket history, balancing HTML email display against processing very large messages.

    View source ↗
  4. 5mo ago

    Same security fixes as 5.0.10, plus dashboard and accessibility work

    The 6.0 half of the 2026-05-20 security pair, carrying the same CVEs as 5.0.10 but bundling the feature work that only lands on this branch: pagination and sorting for saved searches on dashboards, status colors from lifecycle configuration, multi-column custom field display, and improved keyboard menu navigation.

    View source ↗
  5. 1y ago

    Calendar view for saved searches and memory management work

    A feature-carrying 6.0 release with security fixes attached: a calendar view for saved searches, enhanced history filtering and paging, and memory management improvements. It shipped the same day as 5.0.9 and 4.4.9, the usual coordinated pattern.

    View source ↗
  6. 1y ago

    CSV injection fix in TSV export, with assorted updates

    The 5.0 branch's share of the October 2025 coordinated security release, fixing CSV injection through ticket values exported to TSV from search results, alongside a batch of smaller updates and fixes. It is the middle branch of the three released that day.

    View source ↗