Quick answers
- Is CVE-2026-34754 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-34754 being exploited in the wild.
- How severe is CVE-2026-34754?
- Medium severity, with a CVSS score of 4.3, published 20 May 2026.
- Which products and versions are affected?
- MantisBT Mantis Bug Tracker <= 2.28.1; MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.
- Is there a fix for CVE-2026-34754?
- Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-34754 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-34754?
- Check whether you run MantisBT Mantis Bug Tracker, MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later
composer require mantisbt/mantisbt:^2.28.2
Technical details
An authorization bypass vulnerability exists in MantisBT's REST API due to improper access control (CWE-284). An authenticated attacker with low privileges can bypass intended restrictions to upload file attachments to private issues that should be inaccessible to them. The vulnerability is triggered via network requests to the REST API and does not require user interaction. The issue is addressed in version 2.28.2 by implementing proper authorization checks for attachment uploads on private issues.
Affected products
- MantisBT MantisBT <= 2.28.1
Identifiers
- CVE-2026-34754
- GHSA-h4x5-gvx6-3rwc
Timeline
- 2026-05-09: disclosed: Initial disclosure by researcher
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-20: other: NVD publication date