Is there a patch available for CVE-2026-52883?

Yes, a patch is available for CVE-2026-52883. Update the affected software to the latest version immediately.

MantisBT CVE-2026-52883

MEDIUM

Improper Input Validation (CWE-20)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-4vpf-w7qv-5h3q

PHP Code Injection

Severity by source

vuln.today AI

6.5 MEDIUM

Network API attack vector; UPDATER-level authentication required (PR:L); integrity-only impact via billing data corruption; no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 19:15 vuln.today

Analysis Generated

Jul 15, 2026 - 19:15 vuln.today

DescriptionCVE.org

Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note_type integer directly to bugnote_add() without validating that the user is authorized to create that type of note. If the user's access level is higher than *$g_time_tracking_view_threshold*, they can also inject arbitrary hours into billing reports.

REST API also allows injection of TIME_TRACKING notes (but not REMINDER) through the same mc_issue_update() function.

Impact

An attacker with UPDATER access could:

Inject fake billable hours via TIME_TRACKING notes (note_type=2), corrupting billing data exported through MantisBT's billing reports. Organizations that bill clients based on MantisBT time tracking data would generate incorrect invoices, and corrupt time tracking reports could be used to drive project management decisions.
Fake REMINDER notes registered (but without actual sending of notifications).

Patches

https://github.com/mantisbt/mantisbt/commit/de2f71fd88746e963386c214c3ae65a3c4c851b7

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37081
https://mantisbt.org/bugs/view.php?id=37200

Credits

Thanks to the following security researchers for discovering and responsibly reporting the issue

Vishal Shukla
Psalms Christopher Matovu (@byteoverride)

AnalysisAI

Authenticated injection of TIME_TRACKING and REMINDER note types in MantisBT's SOAP and REST APIs allows UPDATER-level users to corrupt billing data and falsify project records. The note_type integer parameter supplied by the caller is passed directly to bugnote_add() in the SOAP endpoint - and through mc_issue_update() in the REST API - without verifying the caller holds sufficient privilege to create that note type. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain UPDATER credentials

Delivery

Send crafted SOAP/REST request to mc_issue_update

Exploit

Supply note_type=2 with inflated time_tracking value

Execution

Server bypasses authorization and calls bugnote_add()

Persist

Fake billable hours recorded in database

Impact

Corrupted billing report exported

Access

Obtain UPDATER credentials

Delivery

Send crafted SOAP/REST request to mc_issue_update

Exploit

Supply note_type=2 with inflated time_tracking value

Execution

Server bypasses authorization and calls bugnote_add()

Persist

Fake billable hours recorded in database

Impact

Corrupted billing report exported

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated session with at minimum UPDATER access level in the target MantisBT project. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated MantisBT user with UPDATER access crafts a SOAP request to `mc_issue_update`, supplying `note_type=2` and an inflated `time_tracking` value on any accessible issue. The server accepts and records the note as a legitimate TIME_TRACKING entry. …
Remediation	Upgrade MantisBT to version 2.28.4, which addresses the vulnerability via commit de2f71fd88746e963386c214c3ae65a3c4c851b7 available at https://github.com/mantisbt/mantisbt/commit/de2f71fd88746e963386c214c3ae65a3c4c851b7. … Detailed patch versions, workarounds, and compensating controls in full report.