Which versions of MantisBT are affected by CVE-2026-42071?

MantisBT deployments are vulnerable to unauthorized access to confidential bug tracking attachments through their API interfaces, allowing standard reporter-level staff to retrieve sensitive internal…. A patch is available.

How to fix or mitigate CVE-2026-42071?

Within 24 hours, verify MantisBT version and identify all users with REPORTER-level access; immediately review and restrict API access through rate limiting or disable REST/SOAP file endpoints if operationally feasible pending patch application. Within 7 days, apply the vendor-released patch to all MantisBT instances per the security advisory, then retest API authorization controls to confirm REPORTER-level users can no longer access restricted attachments. Complete within 30 days by auditing file access logs to identify unauthorized attachment downloads by REPORTER-level users and reviewing REPORTER role assignments for appropriateness within your organization.

MantisBT CVE-2026-42071

Q: What is the CVSS score of CVE-2026-42071?

CVE-2026-42071 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33027 HIGH

Missing Authorization (CWE-862)

2026-05-11 https://github.com/mantisbt/mantisbt

GHSA-pw5x-2mf9-3xc8

Authentication Bypass

7.2

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable API, low complexity, requires an authenticated REPORTER account (PR:L); pure read/download leak so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:46 vuln.today

Analysis Generated

Jul 23, 2026 - 23:46 vuln.today

CVSS changed

May 28, 2026 - 21:22 NVD

7.2 (HIGH)

CVE Published

May 11, 2026 - 19:39 github-advisory

HIGH 7.2

CVE Published

May 11, 2026 - 19:39 nvd

HIGH

DescriptionGitHub Advisory

A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint.

Impact

REPORTER (access level 25) can view file attachments that were uploaded to private bugnotes by DEVELOPER/MANAGER/ADMIN users
Private bugnotes are intended for internal developer discussion; their attachments (logs, screenshots, patches) should be equally protected
The web UI is NOT affected - it filters through bugnote_get_all_visible_bugnotes() first

Patches

029d9d203d9e4ae96b3e59d552fa7395cc1e5071

Workarounds

None

Credits

Thanks to the following security researchers for independently discovering and responsibly reporting the issue.

Vishal Shukla
Tristan Madani (@TristanInSec) from Talence Security
Tang Cheuk Hei (@siunam321)

This advisory's contents was largely copied from Tristan's well-written report.

AnalysisAI

Broken access control in MantisBT's programmatic file APIs lets any authenticated REPORTER-level user (access level 25) download attachments from private bugnotes created by higher-privileged DEVELOPER, MANAGER, or ADMIN users, exposing internal logs, screenshots, and patches. The flaw affects the REST endpoint GET /api/rest/issues/{id}/files and the SOAP mc_issue_attachment_get endpoint, while the web UI is unaffected because it filters through bugnote_get_all_visible_bugnotes(). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and the issue is not on CISA KEV.

Technical ContextAI

MantisBT is a widely used open-source PHP bug tracker, distributed via Composer (pkg:composer/mantisbt_mantisbt). Bugnotes are per-issue comments that can be marked private for internal developer discussion, and attachments inherit that intended visibility. The root cause is CWE-862 (Missing Authorization): the SOAP/REST file path called mci_file_can_download_bug_attachments(), which only checked the bug-level download threshold and reporter ownership but never verified bugnote-level visibility. The commit (029d9d2) removes that helper and instead calls both file_can_download_bug_attachments() and the bugnote-aware file_can_download_bugnote_attachments(), threading the bugnote_id and owner_id through so the private-bugnote visibility check is actually enforced at the API layer as it already was in file_download.php.

RemediationAI

Vendor-released patch: upgrade to MantisBT 2.28.2, which applies commit 029d9d203d9e4ae96b3e59d552fa7395cc1e5071 to enforce bugnote-level visibility in the SOAP/REST file download path. The advisory lists no official workarounds. As compensating controls until patching, restrict who can obtain low-privilege accounts by disabling public/self signup and reviewing existing REPORTER-level users, and consider disabling or network-restricting the REST and SOAP APIs (e.g. via config or a reverse-proxy rule blocking /api/rest/issues/*/files and the SOAP mc_issue_attachment_get endpoint) - with the trade-off that this breaks legitimate API-based integrations and automation. Reserve genuinely sensitive material for issues restricted at the project/access-level, since private-bugnote visibility alone is what fails here. Advisory: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pw5x-2mf9-3xc8.