MantisBT CVE-2026-34579
MEDIUM
GHSA-ggw7-9675-6v4v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires authenticated project membership (PR:L); only partial confidentiality impact via email side-channel; no integrity or availability impact.
Primary rating from Vendor (https://github.com/mantisbt/mantisbt).
CVSS VectorVendor: https://github.com/mantisbt/mantisbt
Lifecycle Timeline
4DescriptionCVE.org
Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue.
Impact
Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content.
Patches
- 0a93267deba445fb9d15250c16e6fdb1246ffa65
Workarounds
None
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
AnalysisAI
Authorization bypass in MantisBT's bug monitoring feature allows authenticated project members to subscribe to email notifications for private issues they are explicitly denied direct access to. Versions 2.26.1 through 2.28.1 are affected; the server-side logic in MonitorAddCommand.php incorrectly uses project-level access checks instead of issue-level access checks, so a crafted POST to bug_monitor_add.php succeeds despite the UI returning an Access Denied response. The result is indirect disclosure of private issue metadata and content via email notifications. No public exploit or active exploitation has been identified; EPSS is 0.04% (11th percentile) and CISA SSVC confirms exploitation status as none.
Technical ContextAI
MantisBT is a PHP-based open-source bug tracking application (CPE: pkg:composer/mantisbt/mantisbt). The flaw resides in core/commands/MonitorAddCommand.php in the validate() method. In the vulnerable code path, the check called access_has_project_level() to evaluate whether the requesting user belongs to the project, but neglected to also call access_has_bug_level() against the specific private issue being monitored. This means the authorization gate evaluated project membership rather than per-issue visibility, allowing users to attach monitor relationships to issues their access level should prohibit. The fix (commit 0a93267) restructures the logic to call access_has_bug_level() for self-monitoring and properly sequences both checks for adding others as monitors. CWE-201 (Information Exposure Through Sent Data) applies because private issue content-title, description, comments, and status updates-is subsequently transmitted to the unauthorized subscriber via email notification side-channels, even though the direct web interface continues to block access.
RemediationAI
Upgrade MantisBT to version 2.28.2, which contains the corrective fix in commit 0a93267deba445fb9d15250c16e6fdb1246ffa65 (https://github.com/mantisbt/mantisbt/commit/0a93267deba445fb9d15250c16e6fdb1246ffa65). Full advisory details are at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-ggw7-9675-6v4v. No vendor-provided workaround exists. For organizations that cannot immediately upgrade, the most effective compensating control is restricting MantisBT project membership exclusively to trusted users who would be authorized to view all issues in the project, since exploitation requires project-level authenticated access. This does not fix the authorization bypass but eliminates the class of attacker who can exploit it. Note that restricting membership may affect legitimate collaboration workflows.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today