Is there a patch available for CVE-2026-49280?

Yes, a patch is available for CVE-2026-49280. Update the affected software to the latest version immediately.

MantisBT CVE-2026-49280

MEDIUM

Missing Authorization (CWE-862)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-m7ph-9558-mrx3

PHP Authentication Bypass

Severity by source

vuln.today AI

4.3 MEDIUM

Network-reachable API, low complexity; PR:L because UPDATER role (default authenticated contributor) is required; integrity-only impact on issue status data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 17:30 vuln.today

Analysis Generated

Jul 15, 2026 - 17:30 vuln.today

DescriptionCVE.org

A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the *$g_set_status_threshold* config is set to a higher level (DEVELOPER by default).

Impact

Unauthorized change in Issue workflow.

Patches

https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37181

Credits

Mamdouh Mahfouz (@mamdouhmahfouz)

AnalysisAI

MantisBT's REST and SOAP APIs fail to enforce the $g_set_status_threshold authorization gate, allowing any authenticated user holding the UPDATER role (the default update permission) to change an issue's workflow status to values that should require DEVELOPER-level access or higher. The vulnerability is confirmed patched in release 2.28.4 with no public exploit or KEV listing. Because UPDATER is the default role for ordinary authenticated contributors, this flaw is broadly reachable on any MantisBT instance where the API is accessible without further hardening of role assignments.

Technical ContextAI

MantisBT is a PHP-based open-source bug tracking system (composer package mantisbt/mantisbt, CPE pkg:composer/mantisbt_mantisbt). It enforces workflow permissions through two distinct config thresholds: $g_update_bug_threshold (controls who can edit a bug generally) and $g_set_status_threshold (controls who can change a bug's status). The SOAP handler mc_issue_update() and the REST API lacked the authorization check against update_bug_status_threshold when processing status-change requests. The commit diff (2d3a553) confirms the root cause: prior to the fix, the SOAP code directly assigned the new status without calling access_has_project_level() against the status-specific threshold. The root cause class is CWE-862 (Missing Authorization) - a function was exposed via API without verifying the caller holds the required permission for that specific operation, even though the permission model existed in the configuration layer.

RemediationAI

Upgrade MantisBT to version 2.28.4, available at https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4. The patch introduces an explicit authorization check in the SOAP API's mc_issue_update() function against the update_bug_status_threshold configuration value before any status change is processed. The vendor advisory confirms no workaround exists. As a compensating control if immediate upgrade is not possible, administrators may restrict API access at the network layer (firewall or reverse proxy rules blocking /api/rest/ and the SOAP endpoint to trusted IP ranges) or elevate $g_update_bug_threshold to match $g_set_status_threshold so that only users already authorized to change status can update issues at all - note this latter mitigation would prevent lower-privileged users from making any bug edits, which may disrupt normal workflows. The official fix commit is https://github.com/mantisbt/mantisbt/commit/2d3a5537605487a1ec5178aba9fe9b5623b6a4e0.