PT-2026-39873 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-19 · CVE-2026-33052

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker (MantisBT) versions 2.28.0 through 2.28.1

Description A low-privileged authenticated user with the add profile threshold permission can create a global profile even without the manage global profile threshold permission. This is achieved by tampering with the user id parameter during a valid profile creation request, leading to privilege escalation.

Recommendations Update to version 2.28.2.

Exploit

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33052

GHSA-68W5-W573-Q2R8

Affected Products

Mantisbt

References · 11

• 🔥 https://mantisbt.org/bugs/view.php?id=36974 · Exploit
• https://osv.dev/vulnerability/GHSA-68w5-w573-q2r8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33052 · Security Note
• https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.2 · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-68w5-w573-q2r8 · Note
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/3f952e68fa864e0e60abc3e84adecf3cfa84c75e · Note
• https://t.me/cveNotify/163956 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056573869507457354 · Twitter Post
• https://t.me/CVEtracker/54183 · Telegram Post
• https://twitter.com/CVEnew/status/2056670112745402774 · Twitter Post