PT-2026-39877 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-19 · CVE-2026-34744

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker (MantisBT) versions prior to 2.82.2

Description MantisBT allows a user to list and download their own attachments from an issue created by another user, even after the issue has been marked as private and read access has been revoked. This results in a minimal loss of confidentiality since only attachments previously uploaded by the user themselves remain accessible.

Recommendations Update to version 2.82.2.

Fix

Improper Preservation of Permissions

Information Disclosure

Weakness Enumeration

CWE-281

CWE-200

Related Identifiers

CVE-2026-34744

GHSA-RMP5-5JJ7-GMVF

Affected Products

Mantisbt

References · 8

• https://osv.dev/vulnerability/GHSA-rmp5-5jj7-gmvf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34744 · Security Note
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/de7bdeec36de066235e38a77bf056917d951c84d · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-rmp5-5jj7-gmvf · Note
• https://t.me/cveNotify/164133 · Telegram Post
• https://mantisbt.org/bugs/view.php?id=36977 · Note
• https://t.me/CVEtracker/54308 · Telegram Post