Executive brief
MantisBT, a popular open-source bug tracking system, contains a flaw where users can still access files they previously uploaded to a ticket even after that ticket has been made private. While this does not allow users to see other people's data, it represents a failure in expected privacy controls when an issue's visibility is restricted. This could lead to minor unauthorized data access if a user was intended to be completely locked out of a specific project or issue.
Technical details
An authorization bypass vulnerability exists in MantisBT (versions up to 2.28.1) due to improper access control checks on attachments. Specifically, the system fails to revoke access to attachments for the original uploader when the parent issue's visibility is changed to 'private' or when the user's permissions to the issue are otherwise removed. An authenticated attacker with network access can exploit this to list and download files they previously attached to an issue they can no longer view. The vulnerability is addressed in version 2.28.2.
Affected products
- MantisBT MantisBT <= 2.28.1
Timeline
- 2026-05-09: disclosed: Initial disclosure by researcher
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-19: other: NVD published date