# CVE-2026-34754: MantisBT improper access control in REST API attachment upload

Source: https://junglewise.ai/threats/cve-2026-34754-mantisbt-improper-access-control-in-rest-api-attachment-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-34754 · Severity: medium · CVSS 4.3 · Published 2026-05-20

MantisBT, a popular open-source bug tracking system, contains a security flaw in its programming interface (REST API). This vulnerability allows a logged-in user to upload file attachments to private issues that they are not supposed to see or access. This could lead to unauthorized data being added to sensitive internal records, potentially disrupting workflows or cluttering private project data.

Technologies: [MantisBT Mantis Bug Tracker](https://junglewise.ai/threats/technologies/mantisbt), [mantisbt/mantisbt (Packagist)](https://junglewise.ai/threats/technologies/mantisbt-mantisbt). Vendors: [MantisBT](https://junglewise.ai/threats/vendors/mantisbt), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-34754 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34754 being exploited in the wild.

**How severe is CVE-2026-34754?** Medium severity, with a CVSS score of 4.3, published 20 May 2026.

**Which products and versions are affected?** MantisBT Mantis Bug Tracker <= 2.28.1; MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.

**Is there a fix for CVE-2026-34754?** Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34754 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34754?** Check whether you run MantisBT Mantis Bug Tracker, MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later

  ```sh
  composer require mantisbt/mantisbt:^2.28.2
  ```


## Technical details

An authorization bypass vulnerability exists in MantisBT's REST API due to improper access control (CWE-284). An authenticated attacker with low privileges can bypass intended restrictions to upload file attachments to private issues that should be inaccessible to them. The vulnerability is triggered via network requests to the REST API and does not require user interaction. The issue is addressed in version 2.28.2 by implementing proper authorization checks for attachment uploads on private issues.

## Affected products

- MantisBT MantisBT <= 2.28.1

## Identifiers

- CVE-2026-34754
- GHSA-h4x5-gvx6-3rwc

## Timeline

- 2026-05-09: disclosed: Initial disclosure by researcher
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-20: other: NVD publication date

## References

- [https://api.github.com/users/shukla304](https://api.github.com/users/shukla304)
- [https://github.com/shukla304](https://github.com/shukla304)
- [https://api.github.com/users/shukla304/gists%7B/gist_id%7D](https://api.github.com/users/shukla304/gists%7B/gist_id%7D)
- [https://api.github.com/users/shukla304/repos](https://api.github.com/users/shukla304/repos)
- [https://avatars.githubusercontent.com/u/6738276?v=4](https://avatars.githubusercontent.com/u/6738276?v=4)
- [https://api.github.com/users/shukla304/events%7B/privacy%7D](https://api.github.com/users/shukla304/events%7B/privacy%7D)

## Related threats

- [MantisBT authentication bypass in SOAP API](https://junglewise.ai/threats/cve-2026-47156-mantisbt-authentication-bypass-in-soap-api)
- [MantisBT stored XSS in print_all_bug_page_word.php](https://junglewise.ai/threats/cve-2026-62944-mantisbt-stored-xss-in-print-all-bug-page-word-php)
- [MantisBT improper input validation in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52883-mantisbt-improper-input-validation-in-rest-and-soap-apis)
- [MantisBT authorization bypass in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52882-mantisbt-authorization-bypass-in-rest-and-soap-apis)
- [MantisBT reflected XSS in admin/install.php](https://junglewise.ai/threats/cve-2026-52881-mantisbt-reflected-xss-in-admin-install-php)