CVE-2012-6581: Bestpractical Request Tracker

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secret key, by leveraging a UI e-mail signing privilege.

Affected products

• Bestpractical Request Tracker: version 3.8.3 only; version 3.8.4 only; version 3.8.7 only; version 3.8.9 only; version 3.8.10 only; version 3.8.11 only; …

Published 2013-07-24. Last modified 2026-06-16.