CVE-2026-34744 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue created by another user even after it becomes private, bypassing read access revocation. The loss of confidentiality caused by this vulnerability is minimal, considering that only attachments previously uploaded by the user themselves remain accessible. This issue has been fixed in version 2.82.2.
An authorization bypass vulnerability has been identified in Mantis Bug Tracker (MantisBT) versions through 2.28.1. This vulnerability allows users to list and download their own attachments from issues created by others, even after those issues have been made private, thereby bypassing read access restrictions. The vulnerability arises because the attachment visibility logic allows users to retain access to their own files, despite losing visibility of the parent issue.
Users can upgrade to MantisBT version 2.28.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/de7bdeec36de066235e38a77bf056917d951c84d | [email protected] | Source CodeVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-rmp5-5jj7-gmvf | [email protected] | AdvisoryRemedyVendor |
| https://mantisbt.org/bugs/view.php?id=36977 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-281 | Improper Preservation of Permissions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mantis Bug Tracker | <= 2.28.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |