PatchSiren cyber security CVE debrief
CVE-2026-34390 mantisbt CVE debrief
Mantis Bug Tracker (MantisBT) versions 2.28.1 and prior contain a privilege escalation vulnerability in the ProjectUsersAddCommand handler (manage_proj_user_add.php). Users with the manage_project_threshold access level (manager by default) can bypass frontend restrictions and forge a higher access_level value to grant project-level administrator access to any user, including themselves, in projects they manage. The impact is limited: project-level administrator access does not confer global administrative privileges such as managing users, projects, plugins, or custom fields, nor does it allow project deletion. The vulnerability stems from insufficient server-side validation of the access_level parameter. This issue has been resolved in version 2.28.2.
- Vendor
- mantisbt
- Product
- Unknown
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-19
- Original CVE updated
- 2026-05-20
- Advisory published
- 2026-05-19
- Advisory updated
- 2026-05-20
Who should care
MantisBT administrators and security teams managing on-premise or self-hosted MantisBT instances, particularly those with multiple project managers or delegated project administration responsibilities.
Technical summary
The vulnerability exists in manage_proj_user_add.php where the ProjectUsersAddCommand handler fails to properly validate the access_level parameter against the actor's own permissions. While the frontend form restricts selectable access levels, the backend accepts and processes forged higher values. This allows a manager (manage_project_threshold) to escalate any user to project administrator within their managed projects. The fix in 2.28.2 adds server-side enforcement of access level boundaries.
Defensive priority
medium
Recommended defensive actions
- Upgrade MantisBT to version 2.28.2 or later to remediate this vulnerability.
- Review project user access levels for any unauthorized elevation that may have occurred prior to patching.
- Implement principle of least privilege by restricting manage_project_threshold access to only necessary personnel.
- Monitor access logs for suspicious project user modifications, particularly access_level changes to administrator.
- Consider implementing additional application-layer access control validation for sensitive operations.
Evidence notes
Vulnerability confirmed through GitHub Security Advisory GHSA-frf7-jhp9-jxm6 and MantisBT bug tracker entries. Fix commit 69e0180f180ed5acf48a8d281a73683a7bf32461 implements additional access control checks. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. CWE-284 (Improper Access Control) identified.
Official resources
2026-05-19