Vulnerabilities & Exploits · Web App Attack

Request Tracker Link Clicks Can Hijack Browser Sessions

A crafted Request Tracker link can run attacker JavaScript in the browser of anyone who opens it. The broken assumption is that a ticketing or admin UI URL is harmless just because it points back to the application.

CERT Polska disclosed CVE-2026-6841 as a reflected cross-site scripting flaw in Best Practical Request Tracker. It affects versions 5.0.4–5.0.9 and 6.0.0–6.0.2, and the attack works through the Page GET parameter.

The real risk is browser-session abuse, not server compromise. If users follow links from email or tickets, a successful click can expose session data or let an attacker act as that user.

1 source · May 21

Timeline

• May 21 Reported by CERT Polska

Sources

• May 21 CERT Polska

  Vulnerability in Request Tracker software

  Cross-site Scripting vulnerability (CVE-2026-6841) has been found in Request Tracker software.

  original

Part of the PlainSec briefing for 2026-05-21

Every edition of this story: Request Tracker Link Clicks Can Hijack Browser Sessions

More from today

• Malicious npm Release Exposed Secrets Before CVE Appeared
• Industrial Routers Become Reusable Botnet Infrastructure
• Android Fraud Operation Targets Carrier Billing Systems