CVE-2026-42071 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 2.23.0 to 2.28.1, a missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint. This vulnerability is fixed in 2.28.2.
A vulnerability in Mantis Bug Tracker (MantisBT) versions 2.23.0 prior to 2.28.1 allows authenticated users with REPORTER+ access to download attachments from private bugnotes via the REST API and SOAP API. The issue arises from a missing authorization check in the file visibility function, which fails to properly restrict access to private attachments based on bugnote visibility. As a result, users can access files linked to private bugnotes that should be hidden from them.
Users can update to MantisBT version 2.28.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/029d9d203d9e4ae96b3e59d552fa7395cc1e5071 | [email protected] | Source CodeVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pw5x-2mf9-3xc8 | [email protected] | AdvisoryRemedyVendor |
| https://mantisbt.org/bugs/view.php?id=27039 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://mantisbt.org/bugs/view.php?id=36985 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://mantisbt.org/bugs/view.php?id=37092 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mantis Bug Tracker | >= 2.23.0, <= 2.28.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |