Vulnerabilities · 116 days ago

Request Tracker Link Clicks Can Hijack Browser Sessions

A crafted Request Tracker link can run attacker JavaScript in the browser of anyone who opens it. The broken assumption is that a ticketing or admin UI URL is harmless just because it points back to the application.

CERT Polska disclosed CVE-2026-6841 as a reflected cross-site scripting flaw in Best Practical Request Tracker. It affects versions 5.0.4–5.0.9 and 6.0.0–6.0.2, and the attack works through the Page GET parameter.

The real risk is browser-session abuse, not server compromise. If users follow links from email or tickets, a successful click can expose session data or let an attacker act as that user.

Timeline

• May 21 Reported by CERT Polska

Sources

1 source covering this story

• CERT Polska May 21

  Vulnerability in Request Tracker software

  Cross-site Scripting vulnerability (CVE-2026-6841) has been found in Request Tracker software.

Entities

• CVE-2026-6841

Part of the PlainSec briefing for 2026-05-21

Editions

• Briefing for 2026-05-21

Related stories

• Malicious npm Release Exposed Secrets Before CVE Appeared
• Industrial Routers Become Reusable Botnet Infrastructure
• Android Fraud Operation Targets Carrier Billing Systems