Quick answers
- Is CVE-2026-33052 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-33052 being exploited in the wild.
- How severe is CVE-2026-33052?
- Medium severity, with a CVSS score of 4, published 19 May 2026.
- Which products and versions are affected?
- MantisBT >= 2.28.0, < 2.28.2, 2.28.0, 2.28.1; mantisbt/mantisbt (Packagist) >= 2.28.0, < 2.28.2, ECOSYSTEM:introduced=2.28.0,fixed=2.28.2.
- Is there a fix for CVE-2026-33052?
- Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-33052 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-33052?
- Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later
composer require mantisbt/mantisbt:^2.28.2
Technical details
An authorization bypass vulnerability exists in MantisBT due to insufficient validation of the 'user_id' parameter during profile creation. An authenticated attacker with 'add_profile_threshold' permissions can manipulate the 'user_id' parameter in a valid request to create a global profile, even if they lack the 'manage_global_profile_threshold' privilege. This is classified as an Authorization Bypass Through User-Controlled Key (CWE-639). The issue is fixed in version 2.28.2.
Affected products
- MantisBT MantisBT >= 2.28.0, < 2.28.2
Identifiers
- CVE-2026-33052
- GHSA-68w5-w573-q2r8
Timeline
- 2026-05-09: disclosed: Initial disclosure by researcher
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-19: patched: NVD publication and patch confirmation