PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42070 mantisbt CVE debrief

MantisBT versions prior to 2.28.2 contain an authorization bypass in the SOAP API. The mc_issue_update() function permits users with update_bug_threshold access (UPDATER role, default level 25) to modify bugnotes—including view state and time tracking—belonging to other users. This circumvents the mc_issue_note_update() function's intended DEVELOPER threshold (level 55). The vulnerability stems from inconsistent permission enforcement between API endpoints. Fixed in version 2.28.2.

Vendor
mantisbt
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running MantisBT instances with multi-user access, particularly those exposing SOAP APIs to external integrations or with UPDATER role users who should not modify others' time tracking data.

Technical summary

The mc_issue_update() SOAP API endpoint in MantisBT fails to validate that the requesting user meets the DEVELOPER threshold (level 55) required for bugnote modifications. Users with update_bug_threshold access (UPDATER, level 25 by default) can supply bugnote parameters that alter view state and time tracking data on notes they do not own. The mc_issue_note_update() function correctly enforces the higher threshold, but mc_issue_update() processes equivalent operations without equivalent checks. This inconsistency allows horizontal privilege escalation within the issue tracking system.

Defensive priority

medium

Recommended defensive actions

  • Upgrade MantisBT to version 2.28.2 or later
  • Review user role assignments for accounts with update_bug_threshold access
  • Audit bugnote modification logs for unauthorized changes between 2026-05-28 and patch deployment
  • Restrict SOAP API access to trusted networks if immediate patching is not feasible
  • Verify mc_issue_note_update() permission checks are enforced consistently across API endpoints

Evidence notes

Official GitHub Security Advisory GHSA-pq86-j2c2-47f6 confirms the authorization bypass and fix version. Commit 6e58fae4f22efdc3987f903c8ba2611de17a9435 contains the remediation. MantisBT bug tracker entries 37089 and 37093 document the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42070 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42070

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42070 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42070

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.