CVE-2012-4733: Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle tra...

Security readout for executives and security teams

Request Tracker could let a logged-in user with ticket modification rights delete tickets even without delete authorization. The business risk is loss or manipulation of support, compliance, or security-case records, especially in organizations that rely on RT for audit trails or operational accountability. Exposure is most likely in organizations running Request Tracker 4.x versions earlier than 4.0.13, particularly where many staff or integrations have ModifyTicket permission. Systems already upgraded to 4.0.13 or later are not indicated as affected by the provided sources. Treat this as a targeted integrity and accountability risk, not an unauthenticated perimeter emergency. Prioritize remediation if RT stores security, legal, customer support, or compliance records, because unauthorized deletion can undermine investigations and reporting. Mitigation focus: Upgrade Request Tracker to 4.0.13 or later, per the release reference.; Review accounts and groups with ModifyTicket permission until fixed.; Review DeleteTicket and custom lifecycle transition permission assignments..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.