Executive brief
MantisBT is a popular open-source bug tracking system used by development teams to manage software defects. A security flaw in its API allows users with low-level permissions to download private file attachments, such as logs or screenshots, that were intended only for internal developer discussion. This could lead to the exposure of sensitive technical data or internal project details to unauthorized individuals.
Technical details
A missing authorization check in MantisBT's file visibility logic allows authenticated users with REPORTER-level access or higher to bypass intended restrictions on private bugnotes. While the web interface correctly filters these attachments, the REST API (GET /api/rest/issues/{id}/files) and SOAP API (mc_issue_attachment_get) endpoints do not properly validate if the requesting user has permission to view files attached to private notes. An attacker can exploit this to download sensitive internal documentation, logs, or patches. The issue is addressed in version 2.28.2 by implementing proper authorization checks in the affected API functions.
Affected products
- MantisBT MantisBT >= 2.23.0, <= 2.28.1
Timeline
- 2026-05-09: disclosed
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-28: advisory: NVD published