Improper access control in MantisBT - CVE-2026-34754
Published: November 6, 2026
Vulnerability identifier: #VU159804
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34754
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to upload attachments to private issues in MantisBT that they are not authorized to access.
The vulnerability exists due to improper access control in the REST API when processing attachment uploads targeting private issues. A low-privileged remote attacker can submit an authenticated upload request and add an attachment to an inaccessible issue without victim interaction.
Affected software
MantisBT
How to mitigate CVE-2026-34754
Install security update from vendor's website.
MantisBT - update to 2.28.2