The vulnerability in bestpractical RT's REST 2.0 API allows a privileged (non-administrative) user to retrieve authentication credentials of other users, including administrators, via the feed endpoints. This results in exposure of sensitive information (CWE-200) and privilege escalation (CWE-269, CWE-863). The same request that leaks credentials also rotates them, invalidating previously distributed feed URLs. The issue affects versions prior to 5.0.10 and versions 6.0.0 up to but excluding 6.0.3. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity. No known exploits in the wild are reported. No explicit vendor advisory or patch links are provided, but fixed versions are stated.

An attacker with privileged but non-administrative access can obtain authentication credentials of other users, including administrators, enabling unauthorized access to sensitive data and potential further privilege escalation. The confidentiality of user credentials is compromised, and availability may be impacted due to feed URL rotation invalidating existing URLs. The high CVSS score reflects the critical nature of this vulnerability.

Upgrade affected RT instances to version 5.0.10 or later if using the 5.x branch, or to version 6.0.3 or later if using the 6.x branch. These versions contain fixes that address the information disclosure and privilege escalation vulnerability in the REST 2.0 API. Patch status is confirmed by the stated fixed versions. No additional vendor advisory is provided; users should verify with bestpractical for any further guidance.