PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40596 mantisbt CVE debrief

CVE-2026-40596 is a high-severity XSS vulnerability in Mantis Bug Tracker (MantisBT) versions 2.11.0 through 2.28.1. An authenticated user can inject arbitrary HTML by updating their account's font family, leading to XSS payload reflection on every MantisBT page. This can be leveraged with another vulnerability (CSP bypass) for account takeover. Users should update to version 2.28.2 or later and implement additional security measures.

Vendor
mantisbt
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

Users of Mantis Bug Tracker (MantisBT) versions 2.11.0 through 2.28.1 should update to version 2.28.2 or later to mitigate this vulnerability. Security teams should review system logs for suspicious activity and monitor for potential exploitation attempts.

Technical summary

The vulnerability allows any authenticated user to inject arbitrary HTML by updating their account's font family. This leads to an XSS payload being reflected on every MantisBT page. When combined with a CSP bypass vulnerability (GHSA-9c3j-xm6v-j7j3), an attacker could achieve account takeover. The issue has been fixed in version 2.28.2. Affected users should verify their MantisBT version and patch status, review system logs for suspicious activity, and monitor for potential exploitation attempts to mitigate this high-severity vulnerability.

Defensive priority

High priority due to the potential for account takeover when combined with another vulnerability.

Recommended defensive actions

  • Update Mantis Bug Tracker (MantisBT) to version 2.28.2 or later
  • Implement additional security measures to prevent account takeover
  • Monitor for suspicious activity on MantisBT installations
  • Review system logs for potential exploitation attempts
  • Perform vulnerability scanning to identify exposed systems
  • Prioritize patching based on asset inventory and exposure
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-05-22T20:16:34.180Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD information. Defenders should verify MantisBT version and patch status, review system logs for suspicious activity, and monitor for potential exploitation attempts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40596 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40596

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40596 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40596

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.