# CVE-2026-34390: MantisBT privilege escalation in ProjectUsersAddCommand

Source: https://junglewise.ai/threats/cve-2026-34390-mantisbt-privilege-escalation-in-projectusersaddcommand  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-34390 · Severity: medium · CVSS 4 · Published 2026-05-19

MantisBT, a popular open-source bug tracking system, contains a vulnerability that allows project managers to elevate their own or others' privileges to project-level administrator. While this does not grant full system-wide administrative control, it allows unauthorized access to project-specific settings. This could lead to unauthorized configuration changes within specific projects.

Technologies: [MantisBT Mantis Bug Tracker](https://junglewise.ai/threats/technologies/mantisbt), [mantisbt/mantisbt (Packagist)](https://junglewise.ai/threats/technologies/mantisbt-mantisbt). Vendors: [MantisBT](https://junglewise.ai/threats/vendors/mantisbt), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-34390 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34390 being exploited in the wild.

**How severe is CVE-2026-34390?** Medium severity, with a CVSS score of 4, published 19 May 2026.

**Which products and versions are affected?** MantisBT Mantis Bug Tracker <= 2.28.1; MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.

**Is there a fix for CVE-2026-34390?** Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34390 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34390?** Check whether you run MantisBT Mantis Bug Tracker, MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later

  ```sh
  composer require mantisbt/mantisbt:^2.28.2
  ```


## Technical details

A privilege escalation vulnerability exists in MantisBT's ProjectUsersAddCommand, affecting both the web UI (manage_proj_user_add.php) and the REST API (PUT /project/{id}/users). While the frontend UI restricts selectable access levels based on the user's role, the backend fails to validate the 'access_level' parameter in the request. An attacker with 'manager' privileges can submit a forged request to assign the 'administrator' role at the project level. This role is limited to project-specific actions and does not grant global instance-wide administrative rights. The issue is fixed in version 2.28.2.

## Affected products

- MantisBT MantisBT <= 2.28.1

## Identifiers

- CVE-2026-34390
- GHSA-frf7-jhp9-jxm6

## Timeline

- 2026-05-09: disclosed
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-19: other: NVD published

## References

- [https://api.github.com/users/dracosectech-code](https://api.github.com/users/dracosectech-code)
- [https://github.com/dracosectech-code](https://github.com/dracosectech-code)
- [https://api.github.com/users/dracosectech-code/gists%7B/gist_id%7D](https://api.github.com/users/dracosectech-code/gists%7B/gist_id%7D)
- [https://api.github.com/users/dracosectech-code/repos](https://api.github.com/users/dracosectech-code/repos)
- [https://avatars.githubusercontent.com/u/266971538?v=4](https://avatars.githubusercontent.com/u/266971538?v=4)
- [https://api.github.com/users/dracosectech-code/events%7B/privacy%7D](https://api.github.com/users/dracosectech-code/events%7B/privacy%7D)

## Related threats

- [MantisBT authentication bypass in SOAP API](https://junglewise.ai/threats/cve-2026-47156-mantisbt-authentication-bypass-in-soap-api)
- [MantisBT stored XSS in print_all_bug_page_word.php](https://junglewise.ai/threats/cve-2026-62944-mantisbt-stored-xss-in-print-all-bug-page-word-php)
- [MantisBT improper input validation in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52883-mantisbt-improper-input-validation-in-rest-and-soap-apis)
- [MantisBT authorization bypass in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52882-mantisbt-authorization-bypass-in-rest-and-soap-apis)
- [MantisBT reflected XSS in admin/install.php](https://junglewise.ai/threats/cve-2026-52881-mantisbt-reflected-xss-in-admin-install-php)