MantisBT 2.28.1 Privilege Escalation: UPDATER users edit others' bugnotes
CVE-2026-42070 Published on May 28, 2026

MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, the mc_issue_update() function in MantisBT allows users having update_bug_threshold access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function. This vulnerability is fixed in 2.28.2.

NVD

Weakness Type

What is an AuthZ Vulnerability?

The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVE-2026-42070 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2026-42070

Want to know whenever a new CVE is published for MantisBT? stack.watch will email you.

MantisBT
 

Affected Versions

mantisbt Version < 2.28.2 is affected by CVE-2026-42070

Exploit Probability

EPSS
0.04%
Percentile
13.69%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.