CVE-2026-34390: MantisBT privilege escalation in ProjectUsersAddCommand

CVE-2026-34390 · Severity: medium · CVSS 4 · Published 2026-05-19

MantisBT, a popular open-source bug tracking system, contains a vulnerability that allows project managers to elevate their own or others' privileges to project-level administrator. While this does not grant full system-wide administrative control, it allows unauthorized access to project-specific settings. This could lead to unauthorized configuration changes within specific projects.

Technologies: MantisBT Mantis Bug Tracker, mantisbt/mantisbt (Packagist). Vendors: MantisBT, Packagist.

Quick answers

Is CVE-2026-34390 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34390 being exploited in the wild.
How severe is CVE-2026-34390?
Medium severity, with a CVSS score of 4, published 19 May 2026.
Which products and versions are affected?
MantisBT Mantis Bug Tracker <= 2.28.1; MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.
Is there a fix for CVE-2026-34390?
Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34390 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-34390?
Check whether you run MantisBT Mantis Bug Tracker, MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later
    composer require mantisbt/mantisbt:^2.28.2

Technical details

A privilege escalation vulnerability exists in MantisBT's ProjectUsersAddCommand, affecting both the web UI (manage_proj_user_add.php) and the REST API (PUT /project/{id}/users). While the frontend UI restricts selectable access levels based on the user's role, the backend fails to validate the 'access_level' parameter in the request. An attacker with 'manager' privileges can submit a forged request to assign the 'administrator' role at the project level. This role is limited to project-specific actions and does not grant global instance-wide administrative rights. The issue is fixed in version 2.28.2.

Affected products

  • MantisBT MantisBT <= 2.28.1

Identifiers

  • CVE-2026-34390
  • GHSA-frf7-jhp9-jxm6

Timeline

  • 2026-05-09: disclosed
  • 2026-05-11: advisory: GitHub Advisory published
  • 2026-05-19: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.