Request Tracker Link Clicks Can Hijack Browser Sessions
A crafted Request Tracker link can run attacker JavaScript in the browser of anyone who opens it. The broken assumption is that a ticketing or admin UI URL is harmless just because it points back to the application.
CERT Polska disclosed CVE-2026-6841 as a reflected cross-site scripting flaw in Best Practical Request Tracker. It affects versions 5.0.4–5.0.9 and 6.0.0–6.0.2, and the attack works through the Page GET parameter.
The real risk is browser-session abuse, not server compromise. If users follow links from email or tickets, a successful click can expose session data or let an attacker act as that user.