The flaw is an SQL injection in the RT issue tracking system where a crafted entry_aggregator input is directly incorporated into database queries without validation. This allows an authenticated attacker to read or modify the RT database, potentially exposing sensitive information or corrupting ticket data. The problem is categorized as CWE-89, the classic SQL injection weakness.

bestpractical RT versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 are vulnerable. Those releases are open‑source ticket trackers. Versions 5.0.10 and 6.0.3 contain the fix and are the correct upgrade target.

The CVSS score of 8.8 signals a high severity issue. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. An attacker must first authenticate to a valid RT account or achieve lateral movement within a network. Once authenticated, the entry_aggregator parameter can be abused to inject SQL commands to read or alter any database rows that the user has permission to access.