MantisBT CVE-2026-34744
MEDIUM
GHSA-rmp5-5jj7-gmvf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via authenticated session (PR:L); confidentiality impact is low and scoped to the attacker's own data; no integrity or availability impact applies.
Primary rating from Vendor (https://github.com/mantisbt/mantisbt).
CVSS VectorVendor: https://github.com/mantisbt/mantisbt
Lifecycle Timeline
4DescriptionCVE.org
MantisBT permits a user to list and download their own attachments from an Issue created by another user, even after that Issue becomes private and direct access to it is denied.
Impact
The loss of confidentiality caused by this vulnerability is minimal, considering that only the attachments that were previously uploaded by the user themselves remains accessible.
Patches
- de7bdeec36de066235e38a77bf056917d951c84d
Workarounds
None.
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
AnalysisAI
Authorization bypass in MantisBT allows authenticated users to continue listing and downloading their own previously uploaded attachments from issues that have since been marked private, circumventing the access denial applied to the issue itself. The affected code paths - IssueFileGetCommand.php and file_api.php - failed to re-evaluate issue-level permissions at attachment retrieval time, meaning the privacy state change was not propagated to the attachment subsystem. No public exploit exists and SSVC confirms no known exploitation; the confidentiality impact is limited because only the requesting user's own attachments remain accessible, not those of other users.
Technical ContextAI
MantisBT is a PHP-based open-source bug and issue tracking system distributed as a Composer package (composer/mantisbt/mantisbt). The root cause is CWE-200 (Exposure of Sensitive Information) arising from incomplete authorization enforcement in two locations: core/commands/IssueFileGetCommand.php, which handled attachment downloads, performed authentication but did not call access_has_bug_level() against the view_bug_threshold config before serving the file; and core/file_api.php's file_bug_has_attachments() function, which similarly omitted an issue-access check. When an issue transitioned to private status, the issue-level access gate correctly blocked direct issue views but the attachment code path remained unguarded, creating a logic inconsistency between the two subsystems.
RemediationAI
Vendor-released patch: 2.28.2. Upgrade MantisBT to version 2.28.2, which resolves the issue via commit de7bdeec36de066235e38a77bf056917d951c84d - adding an access_has_bug_level() check gated on view_bug_threshold in both IssueFileGetCommand.php (blocking unauthorized attachment downloads) and file_api.php (blocking unauthorized attachment listing). The full advisory is at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-rmp5-5jj7-gmvf. The vendor confirms no workaround is available. As an interim compensating control, administrators concerned about sensitive private issues should audit which users uploaded attachments to those issues before privatization and manually remove those attachments; this is operationally disruptive but eliminates the exposed data at rest.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today