PT-2026-39876 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-19 · CVE-2026-34579

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker (MantisBT) versions prior to 2.28.2

Description An authorization bypass exists in the private issue monitoring feature. A user with project-level access can send a crafted POST request to the 'bug monitor add.php' endpoint to add themselves as a monitor for a private issue they are not authorized to access. Although the application returns an Access Denied error, the request is processed and a monitor relationship is established. While direct access to the private issue remains restricted, the user receives email notifications for updates, resulting in the disclosure of the private issue's metadata and content.

Recommendations Update to version 2.28.2.

Fix

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-200

CWE-863

CWE-201

Related Identifiers

CVE-2026-34579

GHSA-GGW7-9675-6V4V

Affected Products

Mantisbt

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-34579 · Security Note
• https://osv.dev/vulnerability/GHSA-ggw7-9675-6v4v · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/0a93267deba445fb9d15250c16e6fdb1246ffa65 · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-ggw7-9675-6v4v · Note
• https://t.me/CVEtracker/54287 · Telegram Post
• https://mantisbt.org/bugs/view.php?id=36975 · Note
• https://t.me/cveNotify/164131 · Telegram Post