PT-2026-39879 · Mantisbt+1 · Mantisbt+1

Shukla304 · Published 2026-05-11 · Updated 2026-05-20 · CVE-2026-34970

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker (MantisBT) versions prior to 2.28.2

Description A bugnote author can access the Revisions page of a note even after losing access to the parent private issue. This leads to the disclosure of the private issue's ID and summary, although the full revision body of the bugnote remains secure.

Recommendations Update to version 2.28.2.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-34970

GHSA-CRMX-4P49-46M2

Affected Products

Mantisbt

Mantisbt/Mantisbt

References · 7

• 🔥 https://mantisbt.org/bugs/view.php?id=36978 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34970 · Security Note
• https://osv.dev/vulnerability/GHSA-crmx-4p49-46m2 · Vendor Advisory
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-crmx-4p49-46m2 · Note
• https://github.com/mantisbt/mantisbt/commit/71df1f67e05b2050cd4bd87839e6cc13747cf03f · Note
• https://github.com/mantisbt/mantisbt · Note
• https://twitter.com/CVEnew/status/2056994213494165511 · Twitter Post