CVE-2026-42070 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, the mc_issue_update() function in MantisBT allows users having update_bug_threshold access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function. This vulnerability is fixed in 2.28.2.
An authorization bypass vulnerability has been identified in Mantis Bug Tracker (MantisBT) versions prior to 2.28.2. The issue arises in the 'mc_issue_update()' function, which allows users with 'update_bug_threshold' access (UPDATER, level 40) to edit bugnotes of other users. This bypasses the 'DEVELOPER' threshold (level 55) required for the 'mc_issue_note_update()' function. Exploitation of this vulnerability enables unauthorized users to modify bugnote content, change view states, and alter time tracking information, all without the necessary permissions.
Users can update to MantisBT version 2.28.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/6e58fae4f22efdc3987f903c8ba2611de17a9435 | [email protected] | Source CodeVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pq86-j2c2-47f6 | [email protected] | AdvisoryRemedyVendor |
| https://mantisbt.org/bugs/view.php?id=37089 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://mantisbt.org/bugs/view.php?id=37093 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mantis Bug Tracker | <= 2.28.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |