RT 6.0.4 -- 2026-10-29

RT 6.0.4 is now available for general use. This release addresses
many security issues and it is recommended that all users upgrade as
soon as possible. See below for details.

In addition to the security updates, this release includes many new
features and updates. The ticket Attachments widget and the ticket
and asset Links widgets are rebuilt with search, filtering, and new
ways to manage attachments and links. The lifecycle editor is updated,
and a new lifecycle viewer widget shows the available statuses and
lets users change status by clicking the graph. New authentication
features include TOTP multi-factor authentication, configurable
password policies, and self-service password reset. And there are many
more updates, improvements, and fixes.

https://download.bestpractical.com/pub/rt/release/rt-6.0.4.tar.gz
https://download.bestpractical.com/pub/rt/release/rt-6.0.4.tar.gz.asc

SHA-256 sums

0db34899b0462e63c15d0cb23308deac1fe0b84104c65c1e528fedeb52fc33e3 rt-6.0.4.tar.gz
e178d015a3cb9fdb52dccdc82fa258efb9189a5119412f04ad272b6a52fbea47 rt-6.0.4.tar.gz.asc

Security

The following security issues are fixed in this release.

Thanks to CERT Polska for reporting the following findings.

RT 6.0 is vulnerable to an authorization bypass in ticket forwarding.
A user with the ForwardMessage right on any ticket can email the
content and attachments of any transaction in RT, including on tickets
they cannot see, to an address of their choosing. This vulnerability is
assigned CVE-2026-108270.
RT 6.0 is vulnerable to cross-site request forgery via the URL
shortener. A crafted short link followed by an administrator can make
rights changes as that administrator, including granting SuperUser.
This vulnerability is assigned CVE-2026-108279.
RT 6.0 is vulnerable to information disclosure via RSS feed URLs. The
authentication string in a feed URL is not bound to its search, so
anyone with a feed URL can run any search with the rights of the feed
owner. This vulnerability is assigned CVE-2026-108278.
RT 6.0 is vulnerable to unauthorized ticket modification and
disclosure via the CreateTickets scrip action. A user with queue-level
ModifyTemplate and ModifyScrips rights can create a Simple template
that creates or updates tickets in other queues. This vulnerability is
assigned CVE-2026-108275.
RT 6.0 is vulnerable to privilege escalation via the REST group
endpoints. A user with AdminGroup on a user-defined group can convert
it into a role group, and a user with ModifyOwnMembership can add
themselves to role groups or the Privileged group. This vulnerability
is assigned CVE-2026-108353.
RT 6.0 is vulnerable to code injection via article templates when
$DisallowExecuteCode is enabled. A user who can create or modify
articles can save Perl code that runs when the article is rendered.
Only instances that enable $EnableArticleTemplates are affected. This
vulnerability is assigned CVE-2026-108341.
RT 6.0 is vulnerable to reflected cross-site scripting in the advanced
lifecycle editor. This vulnerability is assigned CVE-2026-108363.
RT 6.0 is vulnerable to reflected cross-site scripting in the advanced
page layout editor. This vulnerability is assigned CVE-2026-108364.
RT 6.0 is vulnerable to incorrect authorization of the destination
when moving dashboards, saved searches, articles, and REST 2.0 custom
field values, and when creating tickets via REST 2.0. Users could place
content into containers, classes, or objects they have no rights to.
This vulnerability is assigned CVE-2026-108271.
RT 6.0 is vulnerable to forged cryptographic signature status in
incoming GnuPG and S/MIME mail. A sender can make RT display a
verified signature from someone else. This vulnerability is assigned
CVE-2026-108272.
RT 6.0 is vulnerable to disclosure of ticket recipients on the ticket
People and Update pages to users with ReplyToTicket but not
ShowTicket. As a result of this fix, the web UI update forms now
require ShowTicket. This vulnerability is assigned CVE-2026-108273.
RT 6.0 is vulnerable to information disclosure via the REST 1.0 group
endpoints, which did not check the SeeGroup right. This vulnerability is
assigned CVE-2026-108276.
RT 6.0 is vulnerable to cross-site request forgery via
cookie-authenticated REST 2.0 requests. This vulnerability is assigned
CVE-2026-108277.
RT 6.0 is vulnerable to missing object-level authorization on the
default values pages for queues, catalogs, and custom fields, and on
article class settings. Any user with ShowConfigTab can read and change
these settings. This vulnerability is assigned CVE-2026-108280.
RT 6.0 is vulnerable to stored cross-site scripting via unvalidated
saved search options, such as the auto-refresh interval. This
vulnerability is assigned CVE-2026-108345.
RT 6.0 is vulnerable to information disclosure via ticket relationship
graphs, which show the owner and custom field values of linked tickets
the user cannot see. This vulnerability is assigned CVE-2026-108347.
RT 6.0 is vulnerable to cross-site request forgery in the Rights
Inspector, allowing forged revocation of rights grants. This
vulnerability is assigned CVE-2026-108365.
RT 6.0 is vulnerable to cross-site request forgery on the search chart
page, allowing changes to a user's saved chart searches. This
vulnerability is assigned CVE-2026-108371.
RT 6.0 is vulnerable to stored cross-site scripting via custom fields
configured to link to their own value with IncludeContentForValue or
LinkValueTo. This vulnerability is assigned CVE-2026-108343.
RT 6.0 is vulnerable to login cross-site request forgery when
$RestrictLoginReferrer is enabled. This vulnerability is assigned
CVE-2026-108344.
RT 6.0 is vulnerable to disclosure of hidden ticket time fields to
unprivileged users through Self Service export, REST 2.0, and search
when $HideTimeFieldsFromUnprivilegedUsers is enabled. This
vulnerability is assigned CVE-2026-108346.

Thanks to Jurre van Bergen and Threatnotify for reporting the following
findings.

RT 6.0 is vulnerable to remote code execution via a bypass of the
ExecuteCode right. A user with ModifyTemplate but not ShowTemplate can
change the code in a Perl template. This also bypasses
$DisallowExecuteCode. This vulnerability is assigned CVE-2026-108351.
RT 6.0 is vulnerable to an unauthenticated denial of service via
unbounded growth of the CSS cache. This vulnerability is assigned
CVE-2026-108349.
RT 6.0 is vulnerable to missing authorization on the custom field and
custom role edit pages. A user with ShowConfigTab can remove the
applications of a custom field or custom role. This vulnerability is
assigned CVE-2026-108352.
RT 6.0 is vulnerable to a signature trust check bypass in incoming
S/MIME mail, allowing improperly signed messages to be marked as
validly signed. This vulnerability is assigned CVE-2026-108350.
RT 6.0 generates security tokens and password salts with a
non-cryptographic random number generator. These values are now
generated from the system's cryptographic random source. This
vulnerability is assigned CVE-2026-108348.

Thanks to CERT Polska, and to Jurre van Bergen and Threatnotify, for
reporting the following findings.

RT 6.0 is vulnerable to an insecure direct object reference in custom
field values. Users can read, change, or delete custom field values on
objects they have no rights to. This vulnerability is assigned
CVE-2026-108274.
RT 6.0 is vulnerable to multiple stored and reflected cross-site
scripting issues due to insufficient HTML escaping in areas including
HTML ticket descriptions, group and user names, Wikitext custom fields,
chart tables, ticket graphs, the article chooser, dashboard pages and
components, search result formats, and ticket history. This
vulnerability is assigned CVE-2026-108342.
RT 6.0 is vulnerable to missing authorization on the scrip and custom
field admin pages. A user with ShowConfigTab can reorder scrips and
global custom fields and change the stage of global scrips. This
vulnerability is assigned CVE-2026-108281.

Thanks to Mateusz Szymaniec and CERT Polska for reporting the following
finding.

RT 6.0 is vulnerable to stored cross-site scripting via URLs in HTML
ticket content. Links that RT creates automatically from URLs did not
escape the URL, so content from any sender, including unauthenticated
email to a public queue, can run script when the ticket is viewed. This
vulnerability is assigned CVE-2026-105454.

This release also includes the fix for spreadsheet injection via TSV
export headers that was missed in RT 6.0.3, completing the mitigation
for CVE-2026-41073.

Also included are updates to require newer versions of several
dependent Perl modules with security fixes: MIME::Tools 5.522,
HTML::Gumbo 0.19, Starlet 0.33, and Mozilla::CA 20261020.

Multi-Factor Authentication and Password Management

RT 6.0.4 adds several features to help secure user accounts:

TOTP multi-factor authentication, which can be off, optional, or
required for different groups of users.
Configurable password policies, such as minimum length and required
character classes.
Password reset. RT::Extension::ResetPassword is now part of core RT,
with self-service password reset available but disabled by default.

These features add a new $SecretKey configuration option. Set it before
users enroll in MFA. See docs/authentication.pod for details.

General user features

Rebuild the ticket Attachments widget with search, filtering, and
sorting, and allow users with ModifyTicket to add, delete, rename,
and pin attachments, and to download, delete, or copy several
attachments to a new ticket at once
Rebuild the ticket and asset Links widget with inline edit, search,
and filtering
Support adding links to assets, articles, transactions, users,
groups, and external URLs from the Links widget
Add a transaction:// link type so transactions can be linked like
other RT objects
Limit the number of links shown on initial load, with a button to
show more
Add an optional default link type for new links
Move ticket merge from the Links widget to the Actions menu
Add a lifecycle viewer widget for tickets and assets that shows the
statuses and transitions available to the current user
Change ticket status by clicking a status in the lifecycle viewer
Add Active and Inactive options to the search results Status filter
Allow picking multiple assets in the ticket Assets box
Accept typed or pasted input in autocomplete fields when leaving the
field, rather than dropping it
Default the SLA on the ticket update page to the ticket's current
SLA rather than the queue default (thanks @arr2036!)
Load recipients for Reply and Comment actions on dashboards
Keep unchecked recipients unchecked on update pages without the
PreviewScrips widget
Apply article subject overrides on ticket create and update pages
Run dashboard searches as each recipient when subscriptions are
configured that way
Fix the Time Worked report when queue autocomplete is enabled
Fix numeric custom field chart functions for custom fields applied
to specific queues (thanks elacour!)
Fix empty custom role labels on asset bulk update
Remove links to the deleted asset Modify page
Always allow multiple Requestors and Ccs on the Self Service create
page
Align the Self Service article list with the article links portlet
style
Honor $AutocompleteOwners for the Owner input in the Basics widget
Keep inline editors and dropdowns inside the browser window
Dismiss tooltips on mouse leave after a right click
Show the hover color, not the active color, on pressed dropdown items
Make the full width of history and gear menu items clickable
Shrink search and sort controls on mobile sized browsers
Add aria-label to unlabelled checkboxes
Reduce browser CPU use from the checkmark animation
Fix the lifecycle status color picker background in dark mode
Show text content of standalone multipart/related emails when
PreferRichText is enabled
Fix unmatched HTML tags when splitting stanzas at Outlook quote
separators, which could cause duplicated ticket history on scroll
Fix ticket search filters applied to queries with multiple top-level
groups
Style link buttons like input buttons in the dark theme
Only show dashboards in a saved search's dependency list if the user
can see them
Fix searches for tickets with no unread messages on Oracle

Documentation

Add a getting started page for new users
Add authentication docs for password policy, password reset, and MFA
Document the $DisableMFA config option
Document the scheduled process run counter
Note the Attachments and Links widget changes and faster ticket
history search in UPGRADING-6.0
Generate static doc filenames for bin and sbin like bin-rt.html to
avoid case conflicts on case-insensitive file systems

Administration

Convert the lifecycle editor to the Cytoscape library
Add descriptions for statuses and transitions in the lifecycle
editor, shown in the lifecycle viewer
Show a pending changes message and save zoom settings in the
lifecycle editor
Add REST 2.0 endpoints for lifecycle information on tickets and
assets
Speed up searching a single ticket's history on MySQL and MariaDB
when full text indexing is enabled
Add $ProgressiveSearchResultRows to configure progressive loading of
unpaginated search results
Merge CustomFieldGroupings configurations from multiple config files
Honor ShowScrips and ModifyScrips rights granted on a queue
Preserve direct rights when migrating the 6.0.1 saved search and
dashboard rights
Restrict new page layout names to a simple character set and escape
them in URLs
Only accept dashboard and page layout widgets that the editor offered
Generate dashboard email chart images with a one-shot Chromium
process
Keep CSS in dashboard emails when it is not inlined
Use multipart/related for dashboard emails with chart images so more
email clients show images inline
Make the $EmailDashboardIncludeCharts default configurable at build
time
Skip disabled users correctly when building email digests
Add standard --log option to rt-email-digest
Increment the scheduled process run counter on success so weekly
processes run on the configured schedule
Don't count scheduled process runs that failed to start or were
killed by a signal as successful
Avoid "414 Request-URI Too Large" errors when saving large lifecycles
Warn admins to set $SecretKey when MFA is enabled
Warn about unknown date formats only when both date parsers fail
Add the missing Code index for Shorteners
Remove the unused $EditCustomFieldsSingleColumn option
Remove font path support, as share/fonts no longer exists in RT 6
(thanks andrew!)
Honor version upper bounds for dependencies in "make fixdeps"
Require DBIx::SearchBuilder 1.86
Install README.md in the doc-install target (thanks andrew!)

Internals

Sanitize attachment filenames, including Windows paths and control
characters
Store binary transaction OldValue and NewValue in ObjectContent
Add PageLayoutHasWidget function
Add a class for each field to collection table columns, so site CSS
can target columns by field
Delete deprecated code marked for deletion before version 6
Register the dropzone htmx:load listener only once per page
Calculate correct Content-Length for utf8 content in REST 2.0 comment
and correspond responses (thanks @marek-veber!)
Load shorteners by code case sensitively, improving performance on
PostgreSQL and Oracle
Find shortener codes of any length in LoadByContent, so deleting a
saved search also removes its permanent shortener
Only fix up S/MIME preambles that end with a bare CR, for
compatibility with MIME::Tools 5.520
Apply Atomic's cached rights only to the ticket it locked
Require a valid class when changing an article's class
Only allow attribute links between saved searches or the homepage and
dashboards
Do not alter the passed-in object in ProcessObjectCustomFieldUpdates
Organize third-party libraries in directories with license copies
and metadata files
Generate the third-party README from library metadata
Add a tool to check third-party libraries for CVEs and new versions

Testing

Add tests for the Attachments and Links widgets, merge action, and
RT::URI::transaction
Add tests for lifecycle metadata, reachable transitions, layout, and
REST 2.0 lifecycle endpoints
Add tests for password reset, password policy, and TOTP MFA
Add tests for dashboard emails and dashboard searches run as each
recipient
Add tests for DISTINCT searches with ORDER BY
Add tests for single ticket history search on MySQL and MariaDB
Add tests for scrip rights granted on a queue
Add tests for page layout names and unknown dashboard and page layout
widgets
Add playwright tests for article subject override
Add RT::Test::set_config helper for database-backed config changes
Pass the Authorization header through Apache test configs
Test variations of multipart/related email structures
Test Content-Length in REST 2.0 responses with utf8 content
Test loading shorteners by code and by content
Test unmatched tags when splitting stanzas at Outlook quote
separators
Test rt-run-scheduled-processes, including runs killed by a signal
Test lifecycle editor post-save redirect and error handling
Test that the third-party README is up to date
Update the mime_decoding test for MIME::Tools 5.521
Add tests for attachment filename sanitizing
Restore disabled database configs in test mode on refresh
Update tests for Mojolicious 9.50
Update to the latest test images

A complete changelog is available from git by running:
git log rt-6.0.3..rt-6.0.4
or visiting
rt-6.0.3...rt-6.0.4

bestpractical/rt rt-6.0.4 on GitHub

RT 6.0.4 -- 2026-10-29

bestpractical/rt rt-6.0.4
on GitHub