The vulnerability identified as CVE-2026-41074 affects bestpractical rt, an open source issue and ticket tracking system. Versions from 6.0.0 up to but not including 6.0.3 are vulnerable to CSRF attacks. An attacker who tricks an authenticated user into visiting a crafted web page can cause that user’s browser to execute unwanted state-changing requests on the rt system. This could lead to unauthorized modifications of data or system state without the user's consent. The issue is resolved in version 6.0.3.

Successful exploitation allows an attacker to perform arbitrary state-changing actions within the rt system on behalf of an authenticated user. This can result in unauthorized changes to tickets or system configurations. The vulnerability does not impact confidentiality but has a high impact on integrity and a low impact on availability, as reflected by the CVSS vector.

Upgrade affected rt installations to version 6.0.3 or later, where this CSRF vulnerability has been fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor advisory stating the issue is fixed in 6.0.3.