Authorization bypass through user-controlled key in MantisBT - CVE-2026-52882
Published: November 6, 2026
Vulnerability identifier: #VU159812
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52882
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker to assign unreleased product versions to MantisBT issues without the required authorization.
The vulnerability exists due to missing enforcement of report_issues_for_unreleased_versions_threshold when processing issue updates through the REST and SOAP APIs. A low-privileged authenticated attacker can submit an issue update specifying an unreleased product version and have it accepted despite holding only Updater permissions below the configured threshold.
Affected software
MantisBT
How to mitigate CVE-2026-52882
Install security update from vendor's website.
MantisBT - update to 2.28.4