A Cross‑Site Request Forgery vulnerability exists in RT versions 6.0.0 through 6.0.2. An attacker that can trick an authenticated user into visiting a malicious site can cause that user’s session to execute unwarranted actions within RT, potentially altering or deleting tickets and other protected data. This weakness is a classic CSRF flaw (CWE‑352) that compromises user confidentiality, integrity and availability of the issue‑tracking system.

Bestpractical RT 6.0.0 through 6.0.2 are affected. Users deploying these versions are at risk; the update to 6.0.3 addresses the issue.

The CVSS score of 7.1 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector involves a malicious website that an authenticated user is induced to visit, enabling the attacker to cause the user’s session to execute unintended state‑changing actions in RT. Based on the description, the attack requires only a valid user session and the user’s visit to the compromised site; no additional network or authentication prerequisites are necessary.