PT-2026-39890 · Git+2 · Mantisbt+1

Published 2026-05-11 · Updated 2026-05-28 · CVE-2026-42070

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker (MantisBT) versions prior to 2.28.2

Description The mc issue update() function allows users with update bug threshold access (UPDATER) to edit, change the view state, and modify time tracking on bugnotes belonging to other users. This bypasses the default DEVELOPER (level 55) threshold required by the mc issue note update() function. Consequently, an UPDATER can edit notes created by a DEVELOPER, MANAGER, or ADMIN, and can change private notes to public, exposing confidential internal discussions, or change public notes to private, hiding information from reporters and viewers.

Recommendations Update to version 2.28.2.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-42070

GHSA-PQ86-J2C2-47F6

Affected Products

Mantisbt

Mantisbt/Mantisbt

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42070.json · Exploit
• https://osv.dev/vulnerability/GHSA-pq86-j2c2-47f6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42070 · Security Note
• https://github.com/mantisbt/mantisbt/commit/6e58fae4f22efdc3987f903c8ba2611de17a9435 · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pq86-j2c2-47f6 · Note
• https://github.com/mantisbt/mantisbt · Note
• https://mantisbt.org/bugs/view.php?id=37089 · Note
• https://mantisbt.org/bugs/view.php?id=37093 · Note