SB20261106101 - Multiple vulnerabilities in MantisBT

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261106101

SB20261106101 - Multiple vulnerabilities in MantisBT

Published: November 6, 2026

Security Bulletin ID SB20261106101
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 13% Medium 25% Low 63%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2026-62944)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute stored cross-site scripting in a user's browser, with impact limited by MantisBT's Content Security Policy.

The vulnerability exists due to missing output encoding of image attachment filenames in the image alt attribute generated by print_all_bug_page_word.php. An authenticated attacker can upload an image with a crafted filename that injects a JavaScript event handler when a victim views the HTML export page.


2) Input validation error (CVE-ID: CVE-2026-52883)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with UPDATER access to corrupt MantisBT time tracking and reminder records.

The vulnerability exists due to missing validation of user-supplied note types during issue updates through the REST and SOAP APIs. An authenticated attacker with UPDATER access can create unauthorized notes and, when their access level exceeds $g_time_tracking_view_threshold, inject arbitrary billable hours into billing reports.


3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-52882)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to assign unreleased product versions to MantisBT issues without the required authorization.

The vulnerability exists due to missing enforcement of report_issues_for_unreleased_versions_threshold when processing issue updates through the REST and SOAP APIs. A low-privileged authenticated attacker can submit an issue update specifying an unreleased product version and have it accepted despite holding only Updater permissions below the configured threshold.


4) Cross-site scripting (CVE-ID: CVE-2026-52881)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to steal administrator credentials through a fake login form on a legitimate MantisBT page.

The vulnerability exists due to unescaped user-supplied parameters reflected into HTML by MantisBT's /admin/install.php when the installation page remains accessible. An unauthenticated remote attacker can lure an administrator to a crafted URL and receive credentials submitted through the injected form at an attacker-controlled server.


5) Missing Authorization (CVE-ID: CVE-2026-49280)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to make unauthorized changes to issue workflows in MantisBT.

The vulnerability exists due to missing enforcement of $g_set_status_threshold in REST and SOAP API requests that change issue status. A low-privileged authenticated attacker can submit a status change when their access meets $g_update_bug_threshold but falls below $g_set_status_threshold, bypassing the higher permission required to change status.


6) Cross-site scripting (CVE-ID: CVE-2026-52847)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to steal administrator credentials through a fake login form displayed on a legitimate MantisBT page.

The vulnerability exists due to unescaped user-supplied parameters reflected into HTML by print_test_result() in /admin/install.php when the installer remains accessible. An unauthenticated remote attacker can send a crafted URL to an administrator who opens it and submits credentials to an attacker-controlled server.


7) Improper Authentication (CVE-ID: CVE-2026-47156)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to gain administrator access to the MantisBT SOAP API and read, modify, or delete project data.

The vulnerability exists due to SOAP authentication accepting a valid cookie string without binding it to the supplied username. An unauthenticated remote attacker can self-register when signup is enabled, as it is by default, and submit their own cookie with a known administrator username to impersonate the administrator without their password.


8) SQL injection (CVE-ID: CVE-2026-47142)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an administrator to extract sensitive information, including user credentials and private issue data, from the MantisBT database.

The vulnerability exists due to unvalidated concatenation of the history_order configuration value into a SQL ORDER BY clause in the history component. An administrator can plant SQL through the web interface or REST API, causing execution when an authenticated user views an issue with history entries.


Remediation

Install update from vendor's website.

References