CVE-2026-34579
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier are vulnerable to authorization bypass via the private issue monitoring feature. A user with project-level access can add themselves as a monitor for a private issue they cannot access by sending a crafted POST request to bug_monitor_add.php. Despite an Access Denied error, the monitor relationship is created, leading to email notifications that disclose private issue metadata and content. This is fixed in version 2.28.2.
Risk Assessment
The risk is that a user with project access can receive notifications about changes in private issues, leading to disclosure of confidential information.
Recommendation
Update MantisBT to version 2.28.2 or later.
Original NVD description (English source)
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior are vulnerable to Authorization Bypass through the private issue monitoring feature . Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue. Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content. This issue has been fixed in version 2.28.2.