Input validation error in MantisBT - CVE-2026-52883
Published: November 6, 2026
Vulnerability identifier: #VU159811
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52883
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with UPDATER access to corrupt MantisBT time tracking and reminder records.
The vulnerability exists due to missing validation of user-supplied note types during issue updates through the REST and SOAP APIs. An authenticated attacker with UPDATER access can create unauthorized notes and, when their access level exceeds $g_time_tracking_view_threshold, inject arbitrary billable hours into billing reports.
Affected software
MantisBT
How to mitigate CVE-2026-52883
Install security update from vendor's website.
MantisBT - update to 2.28.4