The vulnerability in RT's REST 2.0 API allows a privileged (non-administrative) user to retrieve authentication credentials of other users, including administrators, via the feed endpoints. This results in exposure of sensitive information (CWE-200) and privilege escalation (CWE-269, CWE-863). The exploit also triggers credential rotation, invalidating previously distributed feed URLs. Versions affected are all prior to 5.0.10 and from 6.0.0 up to but excluding 6.0.3. The issue has been fixed in 5.0.10 and 6.0.3. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact.

An attacker with privileged non-administrative access can obtain authentication credentials of other users, including administrators, leading to unauthorized access to sensitive data and potential privilege escalation. The vulnerability also disrupts feed URLs by rotating credentials upon exploitation, impacting legitimate feed access.

Upgrade affected RT instances to version 5.0.10 or later if using the 5.x branch, or to version 6.0.3 or later if using the 6.x branch. These versions contain the official fix for this vulnerability. No other mitigations are indicated by the vendor advisory.