Is there a patch available for CVE-2026-49280?

Yes, a patch is available for CVE-2026-49280. Update the affected software to the latest version immediately.

MantisBT CVE-2026-49280

MEDIUM

Missing Authorization (CWE-862)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-m7ph-9558-mrx3

Authentication Bypass PHP

Severity by source

vuln.today AI

4.3 MEDIUM

Network-reachable API, low complexity; PR:L because UPDATER role (default authenticated contributor) is required; integrity-only impact on issue status data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 17:30 vuln.today

Analysis Generated

Jul 15, 2026 - 17:30 vuln.today

DescriptionCVE.org

A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the *$g_set_status_threshold* config is set to a higher level (DEVELOPER by default).

Impact

Unauthorized change in Issue workflow.

Patches

https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37181

Credits

Mamdouh Mahfouz (@mamdouhmahfouz)

AnalysisAI

MantisBT's REST and SOAP APIs fail to enforce the $g_set_status_threshold authorization gate, allowing any authenticated user holding the UPDATER role (the default update permission) to change an issue's workflow status to values that should require DEVELOPER-level access or higher. The vulnerability is confirmed patched in release 2.28.4 with no public exploit or KEV listing. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as UPDATER-level user

Delivery

Craft REST or SOAP API status-change request

Exploit

Submit request bypassing $g_set_status_threshold check

Execution

Unauthorized status written to database

Impact

Issue workflow integrity violated

Access

Authenticate as UPDATER-level user

Delivery

Craft REST or SOAP API status-change request

Exploit

Submit request bypassing $g_set_status_threshold check

Execution

Unauthorized status written to database

Impact

Issue workflow integrity violated

Vulnerability AssessmentAI

Exploitation	The attacker must hold a valid MantisBT account with at least the UPDATER access level on the target project (UPDATER is the default threshold for $g_update_bug_threshold, so this applies to all ordinary contributors unless the admin has raised that threshold). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No CVSS vector was provided by NVD or the vendor advisory, so scoring here is independently assessed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated MantisBT user assigned the default UPDATER role (e.g., a contractor or reporter with basic edit rights) sends a crafted REST or SOAP API request to change a bug's status from 'new' to 'resolved' or another DEVELOPER-gated state. Because the API handler did not verify the caller's permission against the $g_set_status_threshold, the status change succeeds without triggering an access-denied response. …
Remediation	Upgrade MantisBT to version 2.28.4, available at https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4. … Detailed patch versions, workarounds, and compensating controls in full report.