MantisBT CVE-2026-34754
MEDIUM
GHSA-h4x5-gvx6-3rwc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network REST API endpoint requires low-privilege authentication (PR:L); no confidentiality impact since private issue content is never disclosed to the attacker.
Primary rating from Vendor (https://github.com/mantisbt/mantisbt).
CVSS VectorVendor: https://github.com/mantisbt/mantisbt
Lifecycle Timeline
3DescriptionCVE.org
Impact
MantisBT allows an authenticated user to upload attachments to private Issues they are not authorized to access.
Patches
- b262b4d2835b81394d75356dead66e52a6275206
Workarounds
None.
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
AnalysisAI
Authorization bypass in MantisBT's REST API attachment upload endpoint permits any authenticated project member to attach files to private issues they are not permitted to view. Versions up to and including 2.28.1 are affected via the Composer package mantisbt/mantisbt. No public exploit code exists and CISA SSVC assessment confirms no active exploitation; the real-world threat is limited to insider or compromised-account scenarios where an attacker knows or can enumerate private issue IDs.
Technical ContextAI
MantisBT is an open-source PHP bug tracker distributed via Composer (pkg:composer/mantisbt/mantisbt). The root cause is CWE-284 (Improper Access Control) located in core/file_api.php within the file_allow_bug_upload() function. Prior to commit b262b4d, the function validated only project-level upload permissions using access_has_project_level() against the upload_bug_file_threshold configuration value, completely bypassing the per-issue visibility check. Because private issues restrict which users can view them, a user who meets the project-level threshold but lacks visibility into a specific private issue could still pass the upload gate. The patch introduced by commit b262b4d adds an access_has_bug_level() call when a $p_bug_id is supplied, so that private issue access controls are enforced before permitting attachment uploads. The vulnerability is exercised specifically through the REST API attachment endpoint, as identified in GHSA-h4x5-gvx6-3rwc.
RemediationAI
Upgrade MantisBT to version 2.28.2, which incorporates the fix from commit b262b4d2835b81394d75356dead66e52a6275206 (https://github.com/mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206). For Composer-managed installations, run 'composer update mantisbt/mantisbt' to pull the patched release. The vendor advisory at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwc explicitly states no workarounds are available. As a temporary compensating control before patching, administrators can restrict REST API access at the network perimeter (firewall or reverse-proxy ACL) to trusted IP ranges, or reduce project membership to only fully-trusted users; however, these measures reduce the attack surface without eliminating the underlying authorization flaw and may impact legitimate API integrations.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today