# CVE-2026-33052: MantisBT authorization bypass in global profile creation

Source: https://junglewise.ai/threats/cve-2026-33052-mantisbt-authorization-bypass-in-global-profile-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-33052 · Severity: medium · CVSS 4 · Published 2026-05-19

MantisBT is a popular open-source bug tracking system. A vulnerability has been identified where low-privileged users can bypass security restrictions to create global profiles, a task normally reserved for administrators. This could allow unauthorized users to modify system-wide settings, potentially impacting the organization's workflow and data integrity.

Technologies: [MantisBT](https://junglewise.ai/threats/technologies/mantisbt), [mantisbt/mantisbt (Packagist)](https://junglewise.ai/threats/technologies/mantisbt-mantisbt). Vendors: [MantisBT](https://junglewise.ai/threats/vendors/mantisbt), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-33052 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33052 being exploited in the wild.

**How severe is CVE-2026-33052?** Medium severity, with a CVSS score of 4, published 19 May 2026.

**Which products and versions are affected?** MantisBT >= 2.28.0, < 2.28.2, 2.28.0, 2.28.1; mantisbt/mantisbt (Packagist) >= 2.28.0, < 2.28.2, ECOSYSTEM:introduced=2.28.0,fixed=2.28.2.

**Is there a fix for CVE-2026-33052?** Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33052 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33052?** Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later

  ```sh
  composer require mantisbt/mantisbt:^2.28.2
  ```


## Technical details

An authorization bypass vulnerability exists in MantisBT due to insufficient validation of the 'user_id' parameter during profile creation. An authenticated attacker with 'add_profile_threshold' permissions can manipulate the 'user_id' parameter in a valid request to create a global profile, even if they lack the 'manage_global_profile_threshold' privilege. This is classified as an Authorization Bypass Through User-Controlled Key (CWE-639). The issue is fixed in version 2.28.2.

## Affected products

- MantisBT MantisBT >= 2.28.0, < 2.28.2

## Identifiers

- CVE-2026-33052
- GHSA-68w5-w573-q2r8

## Timeline

- 2026-05-09: disclosed: Initial disclosure by researcher
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-19: patched: NVD publication and patch confirmation

## References

- [https://api.github.com/users/shukla304](https://api.github.com/users/shukla304)
- [https://github.com/shukla304](https://github.com/shukla304)
- [https://api.github.com/users/shukla304/gists%7B/gist_id%7D](https://api.github.com/users/shukla304/gists%7B/gist_id%7D)
- [https://api.github.com/users/shukla304/repos](https://api.github.com/users/shukla304/repos)
- [https://avatars.githubusercontent.com/u/6738276?v=4](https://avatars.githubusercontent.com/u/6738276?v=4)
- [https://api.github.com/users/shukla304/events%7B/privacy%7D](https://api.github.com/users/shukla304/events%7B/privacy%7D)

## Related threats

- [MantisBT authentication bypass in SOAP API](https://junglewise.ai/threats/cve-2026-47156-mantisbt-authentication-bypass-in-soap-api)
- [MantisBT stored XSS in print_all_bug_page_word.php](https://junglewise.ai/threats/cve-2026-62944-mantisbt-stored-xss-in-print-all-bug-page-word-php)
- [MantisBT improper input validation in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52883-mantisbt-improper-input-validation-in-rest-and-soap-apis)
- [MantisBT authorization bypass in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52882-mantisbt-authorization-bypass-in-rest-and-soap-apis)
- [MantisBT reflected XSS in admin/install.php](https://junglewise.ai/threats/cve-2026-52881-mantisbt-reflected-xss-in-admin-install-php)