Information disclosure in MantisBT - CVE-2026-34744
Published: November 6, 2026
Vulnerability identifier: #VU159805
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34744
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to retain access to their own attachments on another user's issue after losing permission to view it.
The vulnerability exists due to an authorization bypass in MantisBT attachment access when an issue becomes private and direct access is denied. An authenticated attacker can list and download attachments they previously uploaded to that issue, causing limited disclosure confined to their own uploads.
Affected software
MantisBT
How to mitigate CVE-2026-34744
Install security update from vendor's website.
MantisBT - update to 2.28.2