CVE-2026-34970

MediumCVSS 5.3

Published: 20/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This is fixed in version 2.28.2.

Risk Assessment

A user who lost access to a private issue can still view the note's revision history, violating confidentiality.

Recommendation

Update MantisBT to version 2.28.2 or later.

Original NVD description (English source)

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This issue has been fixed in version 2.28.2.