MantisBT CVE-2026-34970
MEDIUM
GHSA-crmx-4p49-46m2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible but requires authenticated bugnote authorship (PR:L); only issue ID and summary are exposed (C:L), with no integrity or availability impact.
Primary rating from Vendor (https://github.com/mantisbt/mantisbt).
CVSS VectorVendor: https://github.com/mantisbt/mantisbt
Lifecycle Timeline
4DescriptionCVE.org
MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue.
Impact
Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure.
Patches
- 71df1f67e05b2050cd4bd87839e6cc13747cf03f
Workarounds
None
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
AnalysisAI
MantisBT's bugnote Revisions page in versions up to and including 2.28.1 fails to re-verify a user's access to the parent issue before serving revision metadata, allowing a former bugnote author to retrieve a private issue's ID and summary even after their access to that issue has been revoked. The flaw is in access_can_view_bugnote_revisions() in core/access_api.php, which checked only bugnote authorship - not current parent-issue access rights - creating a broken access control gap. No active exploitation is confirmed in CISA KEV, but the SSVC framework flags the issue as automatable with a POC existing, elevating practical risk in deployments where private issue summaries contain sensitive operational or security data.
Technical ContextAI
MantisBT is an open-source PHP bug tracking system distributed via Composer (mantisbt/mantisbt). The vulnerable code path is the access_can_view_bugnote_revisions() function in core/access_api.php. Prior to the fix in commit 71df1f67, the function granted access to the Revisions page if the requesting user was the bugnote's original reporter, without additionally verifying that the user still satisfies the view_bug_threshold access level for the parent bug. This is a textbook CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) rooted in an incomplete authorization chain: the per-object permission check was not revalidated after privilege changes at the parent-object level. The fix adds an explicit gate that checks both bugnote authorship and current access rights to the parent issue before returning any revision data.
RemediationAI
Upgrade MantisBT to version 2.28.2, which incorporates the authorization fix in commit 71df1f67e05b2050cd4bd87839e6cc13747cf03f (https://github.com/mantisbt/mantisbt/commit/71df1f67e05b2050cd4bd87839e6cc13747cf03f). The full advisory is published at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-crmx-4p49-46m2. No official workarounds are provided by the vendor. As a compensating control before patching, administrators can restrict the add_bugnote_threshold configuration to a higher access level, reducing the pool of users eligible to author bugnotes on private issues - this shrinks but does not eliminate the vulnerable population, and imposes workflow restrictions on legitimate contributors. Alternatively, auditing and removing stale project memberships promptly minimizes the window of exposure by ensuring that access revocations occur quickly after role changes.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today