medium4.3
CVE-2026-34754
MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API
Impact
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mantisbt/mantisbt | <= 2.28.1 | 2.28.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-h4x5-gvx6-3rwc
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwc
- https://github.com/mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206
- https://mantisbt.org/bugs/view.php?id=36976
- https://nvd.nist.gov/vuln/detail/CVE-2026-34754