p PatchFirst

CVE-2026-42071

CVE-2026-42071 · MantisBT: Private Bugnote Attachment Content Leak via REST API

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 2.23.0 to 2.28.1, a missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint. This vulnerability is fixed in 2.28.2.

CVSS 7.2 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mantisbt

    Versions
    • >= 2.23.0, < 2.28.2: Affected

    No fix published

  • mantisbt/mantisbt Packagist

    Versions
    • 2.23.0
    • 2.23.1
    • 2.24.0
    • 2.24.1
    • 2.24.2
    • 2.24.3
    • 2.24.4
    • 2.24.5
    • 2.25.0
    • 2.25.1
    • 2.25.2
    • 2.25.3
    • 2.25.4
    • 2.25.5
    • 2.25.6
    • 2.25.7
    • 2.25.8
    • 2.26.0
    • 2.26.1
    • 2.26.2
    • 2.26.3
    • 2.26.4
    • 2.27.0
    • 2.27.1
    • 2.27.2
    • 2.27.3
    • 2.28.0
    • 2.28.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.23.0, < 2.28.2

    Update to 2.28.2

Original sources

Check your server →