Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-42070MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

Medium 5.3

In plain English

A medium-severity incorrect authorization in mantisbt from mantisbt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, the mc_issue_update() function in MantisBT allows users having update_bug_threshold access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function. This vulnerability is fixed in 2.28.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	mantisbt/mantisbt	2.28.2	GHSA-pq86-j2c2-47f6

Affected products (as reported)

Vendor	Product	Versions
mantisbt	mantisbt	< 2.28.2

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pq86-j2c2-47f6 x_refsource_CONFIRM
https://github.com/mantisbt/mantisbt/commit/6e58fae4f22efdc3987f903c8ba2611de17a9435 x_refsource_MISC
https://mantisbt.org/bugs/view.php?id=37089 x_refsource_MISC
https://mantisbt.org/bugs/view.php?id=37093 x_refsource_MISC