PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42071 mantisbt CVE debrief

Mantis Bug Tracker (MantisBT) versions 2.23.0 through 2.28.1 contain a missing authorization check in the file visibility function that allows any authenticated user with REPORTER privileges or higher to download attachments on private bugnotes they should not be able to access. The vulnerability affects both the REST API endpoint GET /api/rest/issues/{id}/files and the SOAP API mc_issue_attachment_get endpoint. This represents a confidentiality breach where users can access sensitive attachments intended to be restricted to specific project members or higher privilege levels. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and high impact to confidentiality of victim data. The vulnerability was fixed in version 2.28.2 with a commit addressing the authorization gap. Organizations running affected versions should prioritize upgrading to 2.28.2 or later, particularly those hosting MantisBT instances with sensitive bug reports containing confidential attachments.

Vendor
mantisbt
Product
Unknown
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running MantisBT instances with confidential bug reports, particularly those with external reporters or multi-tenant deployments where bugnote privacy boundaries are security-critical

Technical summary

A missing authorization check in MantisBT's file visibility function (CWE-862) allows authenticated users with REPORTER+ privileges to bypass access controls and download attachments from private bugnotes. The vulnerability exists in both REST API (GET /api/rest/issues/{id}/files) and SOAP API (mc_issue_attachment_get) endpoints. Affected versions: 2.23.0 through 2.28.1. Fixed in 2.28.2.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade MantisBT to version 2.28.2 or later to remediate the missing authorization check
  • Review access logs for unusual attachment download patterns by REPORTER-level users via REST API (GET /api/rest/issues/{id}/files) or SOAP API (mc_issue_attachment_get)
  • Audit private bugnotes with attachments to identify potential unauthorized access
  • Implement additional access controls at the web server or API gateway layer to restrict attachment endpoints if immediate patching is not feasible
  • Monitor for exploitation attempts targeting attachment download endpoints

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Affected version range (2.23.0 to 2.28.1) and fix version (2.28.2) confirmed through GitHub security advisory and commit reference. CVSS 4.0 vector and score (7.2 HIGH) from NVD source data. CWE-862 (Missing Authorization) classification from [email protected] source. API endpoints and minimum privilege level (REPORTER+) derived from CVE description.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42071 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42071

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42071 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42071

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.