Is there a patch available for CVE-2026-52883?

Yes, a patch is available for CVE-2026-52883. Update the affected software to the latest version immediately.

MantisBT CVE-2026-52883

MEDIUM

Improper Input Validation (CWE-20)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-4vpf-w7qv-5h3q

PHP Code Injection

Severity by source

vuln.today AI

6.5 MEDIUM

Network API attack vector; UPDATER-level authentication required (PR:L); integrity-only impact via billing data corruption; no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 19:15 vuln.today

Analysis Generated

Jul 15, 2026 - 19:15 vuln.today

DescriptionCVE.org

Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note_type integer directly to bugnote_add() without validating that the user is authorized to create that type of note. If the user's access level is higher than *$g_time_tracking_view_threshold*, they can also inject arbitrary hours into billing reports.

REST API also allows injection of TIME_TRACKING notes (but not REMINDER) through the same mc_issue_update() function.

Impact

An attacker with UPDATER access could:

Inject fake billable hours via TIME_TRACKING notes (note_type=2), corrupting billing data exported through MantisBT's billing reports. Organizations that bill clients based on MantisBT time tracking data would generate incorrect invoices, and corrupt time tracking reports could be used to drive project management decisions.
Fake REMINDER notes registered (but without actual sending of notifications).

Patches

https://github.com/mantisbt/mantisbt/commit/de2f71fd88746e963386c214c3ae65a3c4c851b7

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37081
https://mantisbt.org/bugs/view.php?id=37200

Credits

Thanks to the following security researchers for discovering and responsibly reporting the issue

Vishal Shukla
Psalms Christopher Matovu (@byteoverride)

AnalysisAI

Authenticated injection of TIME_TRACKING and REMINDER note types in MantisBT's SOAP and REST APIs allows UPDATER-level users to corrupt billing data and falsify project records. The note_type integer parameter supplied by the caller is passed directly to bugnote_add() in the SOAP endpoint - and through mc_issue_update() in the REST API - without verifying the caller holds sufficient privilege to create that note type. Attackers with UPDATER access can inject arbitrary billable hours into MantisBT's billing reports, generating fraudulent invoices, and can register fake REMINDER notes via SOAP. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.28.4.

Technical ContextAI

MantisBT is an open-source PHP bug tracker with SOAP and REST APIs. The SOAP endpoint mc_issue_update (in api/soap/mc_issue_api.php) accepts issue note data including a note_type integer field; the vulnerable code casts the field directly to int and passes it to bugnote_add() without checking whether the authenticated user's access level permits that note type. The note type constant BUGNOTE=1, TIME_TRACKING=2, and REMINDER=3 are application-level enumerations, and the authorization gate for TIME_TRACKING is controlled by the $g_time_tracking_view_threshold configuration value - which the vulnerable code never checks. The root cause is CWE-20 (Improper Input Validation): trusted enumeration values are accepted from untrusted input without privilege validation. The REST API shares the same mc_issue_update() code path, enabling TIME_TRACKING injection there as well, though REMINDER injection is SOAP-only. CPE data confirms the affected package as composer/mantisbt/mantisbt. The patch replaces the direct bugnote_add() call with an IssueNoteAddCommand object that enforces proper authorization checks.

RemediationAI

Upgrade MantisBT to version 2.28.4, which addresses the vulnerability via commit de2f71fd88746e963386c214c3ae65a3c4c851b7 available at https://github.com/mantisbt/mantisbt/commit/de2f71fd88746e963386c214c3ae65a3c4c851b7. The vendor advisory is published at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-4vpf-w7qv-5h3q. No official workarounds exist per the advisory. As a compensating control pending upgrade, administrators can restrict UPDATER-level API access by tightening MantisBT access control thresholds, disabling SOAP API access at the web server or firewall layer if not operationally required (note: this would break SOAP integrations), or auditing existing time tracking entries for anomalous hours prior to patching. Disabling SOAP access entirely prevents REMINDER injection but does not address the REST API TIME_TRACKING vector.