CVE-2026-40596 mantisbt CVE debrief

Who should care

Users of Mantis Bug Tracker (MantisBT) versions 2.11.0 through 2.28.1 should update to version 2.28.2 or later to mitigate this vulnerability. Security teams should review system logs for suspicious activity and monitor for potential exploitation attempts.

Technical summary

The vulnerability allows any authenticated user to inject arbitrary HTML by updating their account's font family. This leads to an XSS payload being reflected on every MantisBT page. When combined with a CSP bypass vulnerability (GHSA-9c3j-xm6v-j7j3), an attacker could achieve account takeover. The issue has been fixed in version 2.28.2. Affected users should verify their MantisBT version and patch status, review system logs for suspicious activity, and monitor for potential exploitation attempts to mitigate this high-severity vulnerability.

Defensive priority

High priority due to the potential for account takeover when combined with another vulnerability.

Recommended defensive actions

• Update Mantis Bug Tracker (MantisBT) to version 2.28.2 or later
• Implement additional security measures to prevent account takeover
• Monitor for suspicious activity on MantisBT installations
• Review system logs for potential exploitation attempts
• Perform vulnerability scanning to identify exposed systems
• Prioritize patching based on asset inventory and exposure
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-05-22T20:16:34.180Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD information. Defenders should verify MantisBT version and patch status, review system logs for suspicious activity, and monitor for potential exploitation attempts.

Official resources