RT 5.0.11 -- 2026-10-29

RT 5.0.11 is now available for general use. This release addresses
many security issues and it is recommended that all users upgrade as
soon as possible. See below for details.

In addition to the security updates, this release adds new
authentication features: TOTP multi-factor authentication,
configurable password policies, and self-service password reset.

https://download.bestpractical.com/pub/rt/release/rt-5.0.11.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-5.0.11.tar.gz.asc

SHA-256 sums

f8e9e631938acb37f9cb0189ae63c22009ddd1519041eae79cc55ac337273476 rt-5.0.11.tar.gz
d4d0003d012c2733bc54aaa2108ba30477e2022290e026603fc7803670fbae1e rt-5.0.11.tar.gz.asc

Security

The following security issues are fixed in this release.

Thanks to CERT Polska for reporting the following findings.

• RT 5.0 is vulnerable to an authorization bypass in ticket forwarding.
  A user with the ForwardMessage right on any ticket can email the
  content and attachments of any transaction in RT, including on tickets
  they cannot see, to an address of their choosing. This vulnerability is
  assigned CVE-2026-108270.

• RT 5.0.4 and later are vulnerable to cross-site request forgery via
  the URL shortener. A crafted short link followed by an administrator
  can make rights changes as that administrator, including granting
  SuperUser. This vulnerability is assigned CVE-2026-108279.

• RT 5.0 is vulnerable to information disclosure via RSS feed URLs. The
  authentication string in a feed URL is not bound to its search, so
  anyone with a feed URL can run any search with the rights of the feed
  owner. This vulnerability is assigned CVE-2026-108278.

• RT 5.0 is vulnerable to unauthorized ticket modification and
  disclosure via the CreateTickets scrip action. A user with queue-level
  ModifyTemplate and ModifyScrips rights can create a Simple template
  that creates or updates tickets in other queues. This vulnerability is
  assigned CVE-2026-108275.

• RT 5.0 is vulnerable to privilege escalation via the REST group
  endpoints. A user with AdminGroup on a user-defined group can convert
  it into a role group, and a user with ModifyOwnMembership can add
  themselves to role groups or the Privileged group. This vulnerability
  is assigned CVE-2026-108353.

• RT 5.0 is vulnerable to reflected cross-site scripting in the advanced
  lifecycle editor. This vulnerability is assigned CVE-2026-108363.

• RT 5.0 is vulnerable to incorrect authorization of the destination
  when moving dashboards, saved searches, articles, and REST 2.0 custom
  field values, and when creating tickets via REST 2.0. Users could place
  content into containers, classes, or objects they have no rights to.
  This vulnerability is assigned CVE-2026-108271.

• RT 5.0 is vulnerable to forged cryptographic signature status in
  incoming GnuPG and S/MIME mail. A sender can make RT display a
  verified signature from someone else. This vulnerability is assigned
  CVE-2026-108272.

• RT 5.0 is vulnerable to disclosure of ticket recipients on the ticket
  People and Update pages to users with ReplyToTicket but not
  ShowTicket. As a result of this fix, the web UI update forms now
  require ShowTicket. This vulnerability is assigned CVE-2026-108273.

• RT 5.0 is vulnerable to information disclosure via the REST 1.0 group
  endpoints, which did not check the SeeGroup right. This vulnerability is
  assigned CVE-2026-108276.

• RT 5.0 is vulnerable to cross-site request forgery via
  cookie-authenticated REST 2.0 requests. This vulnerability is assigned
  CVE-2026-108277.

• RT 5.0 is vulnerable to missing object-level authorization on the
  default values pages for queues, catalogs, and custom fields, and on
  article class settings. Any user with ShowConfigTab can read and change
  these settings. This vulnerability is assigned CVE-2026-108280.

• RT 5.0 is vulnerable to information disclosure via ticket relationship
  graphs, which show the owner and custom field values of linked tickets
  the user cannot see. This vulnerability is assigned CVE-2026-108347.

• RT 5.0 is vulnerable to cross-site request forgery in the Rights
  Inspector, allowing forged revocation of rights grants. This
  vulnerability is assigned CVE-2026-108365.

• RT 5.0 is vulnerable to cross-site request forgery on the search chart
  page, allowing changes to a user's saved chart searches. This
  vulnerability is assigned CVE-2026-108371.

• RT 5.0 is vulnerable to stored cross-site scripting via custom fields
  configured to link to their own value with IncludeContentForValue or
  LinkValueTo. This vulnerability is assigned CVE-2026-108343.

• RT 5.0 is vulnerable to login cross-site request forgery when
  $RestrictLoginReferrer is enabled. This vulnerability is assigned
  CVE-2026-108344.

• RT 5.0 is vulnerable to disclosure of hidden ticket time fields to
  unprivileged users through Self Service export, REST 2.0, and search
  when $HideTimeFieldsFromUnprivilegedUsers is enabled. This
  vulnerability is assigned CVE-2026-108346.

Thanks to Jurre van Bergen and Threatnotify for reporting the following
findings.

• RT 5.0 is vulnerable to remote code execution via a bypass of the
  ExecuteCode right. A user with ModifyTemplate but not ShowTemplate can
  change the code in a Perl template. This also bypasses
  $DisallowExecuteCode. This vulnerability is assigned CVE-2026-108351.

• RT 5.0 is vulnerable to an unauthenticated denial of service via
  unbounded growth of the CSS cache. This vulnerability is assigned
  CVE-2026-108349.

• RT 5.0 is vulnerable to missing authorization on the custom field and
  custom role edit pages. A user with ShowConfigTab can remove the
  applications of a custom field or custom role. This vulnerability is
  assigned CVE-2026-108352.

• RT 5.0 is vulnerable to a signature trust check bypass in incoming
  S/MIME mail, allowing improperly signed messages to be marked as
  validly signed. This vulnerability is assigned CVE-2026-108350.

• RT 5.0 generates security tokens and password salts with a
  non-cryptographic random number generator. These values are now
  generated from the system's cryptographic random source. This
  vulnerability is assigned CVE-2026-108348.

Thanks to CERT Polska, and to Jurre van Bergen and Threatnotify, for
reporting the following findings.

• RT 5.0 is vulnerable to an insecure direct object reference in custom
  field values. Users can read, change, or delete custom field values on
  objects they have no rights to. This vulnerability is assigned
  CVE-2026-108274.

• RT 5.0 is vulnerable to an insecure direct object reference in saved
  search handling. Users can read other users' private saved searches,
  take over their dashboards, and change their dashboard subscriptions.
  This vulnerability is assigned CVE-2026-108282.

• RT 5.0 is vulnerable to multiple stored and reflected cross-site
  scripting issues due to insufficient HTML escaping in areas including
  group and user names, Wikitext custom fields, chart tables, ticket
  graphs, the article topic chooser, dashboard pages, search result
  formats, and ticket history. This vulnerability is assigned
  CVE-2026-108342.

• RT 5.0 is vulnerable to missing authorization on the scrip and custom
  field admin pages. A user with ShowConfigTab can reorder scrips and
  global custom fields and change the stage of global scrips. This
  vulnerability is assigned CVE-2026-108281.

Thanks to Mateusz Szymaniec and CERT Polska for reporting the following
finding.

• RT 5.0 is vulnerable to stored cross-site scripting via URLs in HTML
  ticket content. Links that RT creates automatically from URLs did not
  escape the URL, so content from any sender, including unauthenticated
  email to a public queue, can run script when the ticket is viewed. This
  vulnerability is assigned CVE-2026-105454.

Also included are updates to require newer versions of several
dependent Perl modules with security fixes: MIME::Tools 5.522,
HTML::Gumbo 0.19, Starlet 0.33, and Mozilla::CA 20261020.

Multi-Factor Authentication and Password Management

RT 5.0.11 adds several features to help secure user accounts:

• TOTP multi-factor authentication, which can be off, optional, or
  required for different groups of users.
• Configurable password policies, such as minimum length and required
  character classes.
• Password reset. RT::Extension::ResetPassword is now part of core RT,
  with self-service password reset available but disabled by default.

These features add a new $SecretKey configuration option. Set it before
users enroll in MFA. See docs/authentication.pod for details.

General user features

• Show text content of standalone multipart/related emails when
  PreferRichText is enabled
• Fix unmatched HTML tags when splitting stanzas at Outlook quote
  separators, which could cause duplicated ticket history on scroll
• Fix ticket search filters applied to queries with multiple top-level
  groups
• Style link buttons like input buttons in the dark theme
• Only show dashboards in a saved search's dependency list if the user
  can see them
• Fix searches for tickets with no unread messages on Oracle

Documentation

• Add authentication docs for password policy, password reset, and MFA
• Document the $DisableMFA config option
• Document the scheduled process run counter
• Generate static doc filenames for bin and sbin like bin-rt.html to
  avoid case conflicts on case-insensitive file systems

Administration

• Add standard --log option to rt-email-digest
• Increment the scheduled process run counter on success so weekly
  processes run on the configured schedule
• Don't count scheduled process runs that failed to start or were
  killed by a signal as successful
• Avoid "414 Request-URI Too Large" errors when saving large lifecycles
• Warn admins to set $SecretKey when MFA is enabled
• Only accept dashboard portlets that the dashboard edit form offered
• Install README.md in the doc-install target

Internals

• Calculate correct Content-Length for utf8 content in REST 2.0 comment
  and correspond responses (thanks @marek-veber!)
• Load shorteners by code case sensitively, improving performance on
  PostgreSQL and Oracle
• Find shortener codes of any length in LoadByContent, so deleting a
  saved search also removes its permanent shortener
• Only fix up S/MIME preambles that end with a bare CR, for
  compatibility with MIME::Tools 5.520
• Apply Atomic's cached rights only to the ticket it locked
• Require a valid class when changing an article's class
• Only allow attribute links between saved searches or the homepage and
  dashboards
• Do not alter the passed-in object in ProcessObjectCustomFieldUpdates
• Organize third-party libraries in directories with license copies
  and metadata files
• Generate the third-party README from library metadata
• Add a tool to check third-party libraries for CVEs and new versions

Testing

• Add RT::Test::set_config helper for database-backed config changes
• Pass the Authorization header through Apache test configs
• Test variations of multipart/related email structures
• Test Content-Length in REST 2.0 responses with utf8 content
• Test loading shorteners by code and by content
• Test unmatched tags when splitting stanzas at Outlook quote
  separators
• Test rt-run-scheduled-processes, including runs killed by a signal
• Test lifecycle editor post-save redirect and error handling
• Test that the third-party README is up to date
• Update the mime_decoding test for MIME::Tools 5.521
• Add tests for password reset, password policy, and TOTP MFA
• Update to the latest test images

A complete changelog is available from git by running:
git log rt-5.0.10..rt-5.0.11
or visiting
rt-5.0.10...rt-5.0.11