CVE-2026-34754: MantisBT improper access control in REST API attachment upload

Executive brief

MantisBT, a popular open-source bug tracking system, contains a security flaw in its programming interface (REST API). This vulnerability allows a logged-in user to upload file attachments to private issues that they are not supposed to see or access. This could lead to unauthorized data being added to sensitive internal records, potentially disrupting workflows or cluttering private project data.

Technical details

An authorization bypass vulnerability exists in MantisBT's REST API due to improper access control (CWE-284). An authenticated attacker with low privileges can bypass intended restrictions to upload file attachments to private issues that should be inaccessible to them. The vulnerability is triggered via network requests to the REST API and does not require user interaction. The issue is addressed in version 2.28.2 by implementing proper authorization checks for attachment uploads on private issues.

Affected products

• MantisBT MantisBT <= 2.28.1

Timeline

• 2026-05-09: disclosed: Initial disclosure by researcher
• 2026-05-11: advisory: GitHub Advisory published
• 2026-05-20: other: NVD publication date

References

• https://api.github.com/users/shukla304
• https://github.com/shukla304
• https://api.github.com/users/shukla304/gists%7B/gist_id%7D
• https://api.github.com/users/shukla304/repos
• https://avatars.githubusercontent.com/u/6738276?v=4
• https://api.github.com/users/shukla304/events%7B/privacy%7D