medium5.3
CVE-2026-52882
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Impact
### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions. ### Patches - https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f ### Workarounds None ### Resources - https://mantisbt.org/bugs/view.php?id=37065 ### Credits MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mantisbt/mantisbt | <= 2.28.3 | 2.28.4 |