p PatchFirst

CVE-2026-33052

CVE-2026-33052 · MantisBT: Authorization Bypass in Global Profile Creation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mantisbt

    Versions
    • >= 2.28.0, < 2.28.2: Affected

    No fix published

  • mantisbt/mantisbt Packagist

    Versions
    • 2.28.0
    • 2.28.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.28.0, < 2.28.2

    Update to 2.28.2

Original sources

Check your server →