Is there a patch available for CVE-2026-52882?

Yes, a patch is available for CVE-2026-52882. Update the affected software to the latest version immediately.

MantisBT CVE-2026-52882

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-3v2j-6fw9-f57c

PHP Authentication Bypass

Severity by source

vuln.today AI

4.3 MEDIUM

Network-reachable, low-complexity bypass requiring an authenticated low-privilege account (PR:L); impact is integrity-only via version field manipulation with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 19:02 vuln.today

Analysis Generated

Jul 15, 2026 - 19:02 vuln.today

DescriptionCVE.org

Impact

Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions.

Patches

https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37065

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

AnalysisAI

Authorization bypass in MantisBT's SOAP API, REST API, and web-based bug update interface allows authenticated lower-privileged users to assign unreleased product versions to issues, circumventing the report_issues_for_unreleased_versions_threshold access control. All three issue-update pathways in versions 2.28.3 and earlier were unprotected: the SOAP handler (mc_issue_api.php), the web form (bug_update.php), and the REST command layer (IssueAddCommand.php). No public exploit code and no active exploitation (CISA KEV) have been identified; vendor-released patch version 2.28.4 closes all three vectors.

Technical ContextAI

MantisBT is a PHP-based open-source bug tracking system distributed via Composer (pkg:composer/mantisbt/mantisbt). Its role-based access model uses a configurable threshold (report_issues_for_unreleased_versions_threshold) to restrict which permission levels may interact with product versions not yet marked as released. The root cause maps to CWE-639 (Authorization Bypass Through User-Controlled Key): the version field supplied in issue-create and issue-update requests was not validated against this threshold at the server side across any of the three exposed surfaces. The commit diff shows the fix adds access_has_project_level(config_get('report_issues_for_unreleased_versions_threshold')) checks in each affected pathway and introduces a standalone version_is_released() helper in core/version_api.php to centralise the released-state lookup, ensuring consistent enforcement.

RemediationAI

Upgrade to MantisBT version 2.28.4 via Composer (composer require mantisbt/mantisbt:^2.28.4); this version introduces server-side authorization checks in the SOAP handler (api/soap/mc_issue_api.php), the web UI update script (bug_update.php), and the REST command layer (core/commands/IssueAddCommand.php). The patch commit is available at https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f. No official workarounds are documented by the vendor. As a compensating control prior to upgrade, administrators can restrict SOAP and REST API access to trusted IP ranges via reverse-proxy ACLs or web-server Require ip directives, reducing the exploitable surface to the web UI alone - note this does not eliminate the vulnerability and may disrupt legitimate API integrations.