CVE-2026-52882: MantisBT REST and SOAP API Vulnerability Allows Assignment of Unreleased Product Versions
Summary
CVE-2026-52882: MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters. Affects mantisbt/mantisbt versions < 2.28.4. Fixed in 2.28.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is a widely used open-source issue tracker that helps teams manage and track bugs and feature requests. It offers REST and SOAP APIs for integration with other systems, enabling developers to automate workflows and enhance productivity. However, a recent vulnerability has been identified that allows users to assign unreleased product versions, potentially leading to confusion and mismanagement of project timelines.
Vulnerability Detail
The vulnerability arises from the improper handling of permissions related to unreleased product versions in the MantisBT REST and SOAP APIs. Users with the 'report_issues_for_unreleased_versions_threshold' set below a certain level can assign unreleased versions, which could lead to unauthorized access and manipulation of project data. This could result in significant project management issues, as unreleased versions may not be stable or ready for public use.
How To Fix
Minimum fixed version
2.28.4
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.28.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no workarounds available for this vulnerability. It is strongly recommended to update to the patched version as soon as possible.
Conclusion
In summary, the CVE-2026-52882 vulnerability in MantisBT allows users to assign unreleased product versions through its APIs, posing a risk to project management. Users are advised to update to version 2.28.4 or later to mitigate this issue.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized assignment of unreleased product versions, causing project management issues and potential instability in the software.
Yes, a patch is available in version 2.28.4 of MantisBT. It is recommended to update to this version to mitigate the risk.
The vulnerability was discovered and responsibly reported by Vishal Shukla.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
