SB2026110699 - Multiple vulnerabilities in MantisBT

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110699

SB2026110699 - Multiple vulnerabilities in MantisBT

Published: November 6, 2026 Updated: November 8, 2026

Security Bulletin ID SB2026110699
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 18
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 11% Low 89%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 18 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2026-39960)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated user with bug report permission to execute arbitrary JavaScript in another user's browser.

The vulnerability exists due to improper escaping of textarea custom field values when MantisBT renders the Update Issue page for a project configured with such a field. An authenticated user with bug report permission can store a malicious value that steals an administrator's session when the administrator opens the issue edit form, provided Content-Security Policy settings permit script execution.


2) Missing Authorization (CVE-ID: CVE-2026-42071)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with REPORTER or higher privileges to download confidential attachments from private bugnotes in MantisBT.

The vulnerability exists due to a missing authorization check in the file visibility function when attachment requests arrive through the REST or SOAP API. An authenticated attacker with REPORTER or higher privileges can request these attachments directly through either API and retrieve their contents without permission to view the associated private bugnotes.


3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-33052)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged authenticated attacker to create global profiles in MantisBT without the required global profile management permission.

The vulnerability exists due to insufficient authorization checks when a valid profile creation request contains a tampered user_id parameter. A low-privileged authenticated attacker can exploit this with add_profile_threshold permission despite lacking manage_global_profile_threshold permission, causing an unauthorized global profile to be created.


4) Improper access control (CVE-ID: CVE-2026-34390)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker with project-management privileges to gain project-level administrator access in MantisBT.

The vulnerability exists due to insufficient access checks in the project-user addition handler when processing a forged higher access level. A remote attacker with project-management privileges can submit a crafted request to grant this role to themselves or others in projects where they meet manage_project_threshold (manager by default), without gaining instance-wide administrative privileges.


5) Cross-site scripting (CVE-ID: CVE-2026-34463)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an administrator to inject stored HTML into MantisBT's issue cloning form, enabling cross-site scripting.

The vulnerability exists due to insufficient escaping of the source project name in bug_report_page.php when cloning an issue from a project other than the current one. An administrator can set a malicious project name that injects attacker-controlled content when a user opens the affected clone form.


6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-34579)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with project-level access to obtain metadata and content from private MantisBT issues they are not authorized to view.

The vulnerability exists due to insufficient authorization enforcement in bug_monitor_add.php when a crafted POST request adds a monitor to a private issue. An authenticated attacker with project-level access can subscribe themselves to the issue and receive update emails even though direct access to the issue remains blocked.


7) Information disclosure (CVE-ID: CVE-2026-34744)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to retain access to their own attachments on another user's issue after losing permission to view it.

The vulnerability exists due to an authorization bypass in MantisBT attachment access when an issue becomes private and direct access is denied. An authenticated attacker can list and download attachments they previously uploaded to that issue, causing limited disclosure confined to their own uploads.


8) Improper access control (CVE-ID: CVE-2026-34754)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to upload attachments to private issues in MantisBT that they are not authorized to access.

The vulnerability exists due to improper access control in the REST API when processing attachment uploads targeting private issues. A low-privileged remote attacker can submit an authenticated upload request and add an attachment to an inaccessible issue without victim interaction.


9) Information disclosure (CVE-ID: CVE-2026-34970)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker with low privileges to read the identifier and summary of a private MantisBT issue.

The vulnerability exists due to insufficient enforcement of parent issue access restrictions on the bugnote Revisions page after access is revoked. A remote attacker with low privileges who previously authored a bugnote can open its Revisions page and obtain the private issue metadata.


10) Cross-site scripting (CVE-ID: CVE-2026-33548)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote authenticated attacker with low privileges to inject HTML into another user's MantisBT Timeline.

The vulnerability exists due to improper escaping of historical tag names in the Timeline at my_view_page.php when tags have been renamed or deleted. A remote authenticated attacker with low privileges can supply a malicious tag name to execute arbitrary JavaScript when a victim views the affected Timeline and Content Security Policy settings permit execution.


11) Cross-site scripting (CVE-ID: CVE-2026-40596)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to inject HTML into MantisBT pages and achieve account takeover when combined with a separate content security policy bypass.

The vulnerability exists due to improper neutralization of the account font family preference when MantisBT renders pages. An authenticated attacker can save a malicious font family value that is included in every subsequently viewed MantisBT page.


12) Improperly implemented security check for standard (CVE-ID: CVE-2026-40597)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to bypass MantisBT's Content Security Policy and execute JavaScript through a pre-existing XSS or HTML injection vulnerability.

The vulnerability exists due to crafted issue attachments being served through file_download.php with a valid JavaScript MIME type that satisfies the policy's script-source restrictions. A low-privileged remote attacker can upload such an attachment and reference it through the existing injection vulnerability to execute scripts in a victim's browser.


13) Cross-site scripting (CVE-ID: CVE-2026-40598)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute malicious scripts in a victim's browser on certain MantisBT server configurations.

The vulnerability exists due to improper escaping of a redirection URL taken from the Referer header on the tag update page. An unauthenticated remote attacker can supply a crafted Referer header to inject HTML and potentially poison a cache, leading to cross-site scripting when a victim views the affected page.


14) Cross-site scripting (CVE-ID: CVE-2026-40607)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a privileged remote attacker to execute arbitrary JavaScript in another user's browser.

The vulnerability exists due to incorrect escaping of the saved-filter owner column in MantisBT when $g_show_user_realname is enabled. A privileged remote attacker can publish a saved filter containing malicious owner content that executes when a victim views the listing, with Manager access or higher required by default to publish filters.


15) Cross-site scripting (CVE-ID: CVE-2026-41897)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote authenticated attacker to execute arbitrary JavaScript in a victim's browser through reflected cross-site scripting in MantisBT.

The vulnerability exists due to missing validation of the filter_target parameter in return_dynamic_filters.php when rendering a TEXTAREA custom field. A remote authenticated attacker can craft a request targeting such a field and induce a victim to open it, causing injected HTML to execute as script.


16) Incorrect authorization (CVE-ID: CVE-2026-42070)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to modify other users' bugnotes and expose confidential discussions in MantisBT.

The vulnerability exists due to incorrect authorization in the issue update API, which accepts bugnote changes with update_bug_threshold permissions, granted to UPDATER users by default, instead of requiring DEVELOPER access. An authenticated attacker can submit issue updates with these permissions to edit other users' notes or make private notes public.


17) Cross-site scripting (CVE-ID: CVE-2026-44655)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a manager or administrator to inject stored cross-site scripting content into the MantisBT Move Attachments admin page viewed by another administrator.

The vulnerability exists due to missing escaping of stored project names when they are displayed on the Move Attachments admin page. A manager or administrator with permission to set project names can store malicious HTML that is rendered when another administrator opens the page.


18) Cross-site scripting (CVE-ID: CVE-2026-44657)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated remote attacker to execute JavaScript in a victim's browser through stored cross-site scripting in MantisBT.

The vulnerability exists due to unsafe inline rendering of uploaded XHTML attachments by file_download.php when show_inline=1 and a valid file_show_inline_token CSRF token are supplied. An authenticated remote attacker can upload crafted XHTML referencing an uploaded JavaScript attachment and induce a victim to view it inline, triggering script execution.


Remediation

Install update from vendor's website.

References