Incorrect authorization in MantisBT - CVE-2026-42070
Published: November 6, 2026
Vulnerability identifier: #VU159796
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42070
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to modify other users' bugnotes and expose confidential discussions in MantisBT.
The vulnerability exists due to incorrect authorization in the issue update API, which accepts bugnote changes with update_bug_threshold permissions, granted to UPDATER users by default, instead of requiring DEVELOPER access. An authenticated attacker can submit issue updates with these permissions to edit other users' notes or make private notes public.
Affected software
MantisBT
How to mitigate CVE-2026-42070
Install security update from vendor's website.
MantisBT - update to 2.28.2