CVE-2026-34579 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue. Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content. This issue has been fixed in version 2.28.2.
An authorization bypass vulnerability has been identified in Mantis Bug Tracker (MantisBT) versions 2.28.1 and prior. The issue arises in the private issue monitoring feature, where a user with project-level access can add themselves as a monitor for a private issue they do not have permission to view. This is achieved by sending a crafted POST request to 'bug_monitor_add.php', using a valid monitor add token from an accessible issue and replacing the 'bug_id' with that of the private issue. Although the application displays an 'Access Denied' error, it processes the request and establishes a monitoring relationship for the private issue. While direct access to the issue remains restricted, the user receives email notifications about updates, inadvertently disclosing the private issue's metadata and content.
Users can update to MantisBT version 2.28.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/0a93267deba445fb9d15250c16e6fdb1246ffa65 | [email protected] | Source CodeVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-ggw7-9675-6v4v | [email protected] | AdvisoryRemedyVendor |
| https://mantisbt.org/bugs/view.php?id=36975 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mantis Bug Tracker | >= 2.26.1, <= 2.28.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |