# CVE-2026-52883: MantisBT improper input validation in REST and SOAP APIs

Source: https://junglewise.ai/threats/cve-2026-52883-mantisbt-improper-input-validation-in-rest-and-soap-apis  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-52883 · Severity: medium · CVSS 4 · Published 2026-07-15

MantisBT is a popular open-source bug tracking system used by organizations to manage software projects and client billing. A vulnerability in its API allows users with basic update permissions to inject unauthorized time-tracking entries and reminders. This could lead to fraudulent billable hours being added to project reports, resulting in incorrect client invoices and corrupted project management data.

Technologies: [MantisBT](https://junglewise.ai/threats/technologies/mantisbt), [mantisbt/mantisbt (Packagist)](https://junglewise.ai/threats/technologies/mantisbt-mantisbt). Vendors: [MantisBT](https://junglewise.ai/threats/vendors/mantisbt), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-52883 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52883 being exploited in the wild.

**How severe is CVE-2026-52883?** Medium severity, with a CVSS score of 4, published 15 July 2026.

**Which products and versions are affected?** MantisBT <= 2.28.3; mantisbt/mantisbt (Packagist) <= 2.28.3, ECOSYSTEM:introduced=0,fixed=2.28.4.

**Is there a fix for CVE-2026-52883?** Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52883 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-52883?** Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mantisbt/mantisbt (Packagist): upgrade to 2.28.4 or later

  ```sh
  composer require mantisbt/mantisbt:^2.28.4
  ```


## Technical details

An improper input validation vulnerability exists in the mc_issue_update SOAP and REST API endpoints of MantisBT. The application passes a user-supplied 'note_type' integer directly to the bugnote_add() function without verifying if the user has the required authorization for that specific note type. An attacker with 'UPDATER' access can exploit this to inject 'TIME_TRACKING' (note_type=2) or 'REMINDER' notes. If the attacker's access level meets the time tracking view threshold, they can successfully inject arbitrary billable hours into the system's database. The issue is fixed in version 2.28.4.

## Affected products

- MantisBT MantisBT <= 2.28.3

## Identifiers

- CVE-2026-52883
- GHSA-4vpf-w7qv-5h3q

## Timeline

- 2026-07-15: advisory: GitHub Advisory GHSA-4vpf-w7qv-5h3q published
- 2026-07-15: patched: Fix committed in version 2.28.4

## References

- [https://api.github.com/users/byteoverride](https://api.github.com/users/byteoverride)
- [https://github.com/byteoverride](https://github.com/byteoverride)
- [https://api.github.com/users/byteoverride/gists%7B/gist_id%7D](https://api.github.com/users/byteoverride/gists%7B/gist_id%7D)
- [https://api.github.com/users/byteoverride/repos](https://api.github.com/users/byteoverride/repos)
- [https://avatars.githubusercontent.com/u/182125216?v=4](https://avatars.githubusercontent.com/u/182125216?v=4)
- [https://api.github.com/users/byteoverride/events%7B/privacy%7D](https://api.github.com/users/byteoverride/events%7B/privacy%7D)

## Related threats

- [MantisBT authentication bypass in SOAP API](https://junglewise.ai/threats/cve-2026-47156-mantisbt-authentication-bypass-in-soap-api)
- [MantisBT stored XSS in print_all_bug_page_word.php](https://junglewise.ai/threats/cve-2026-62944-mantisbt-stored-xss-in-print-all-bug-page-word-php)
- [MantisBT authorization bypass in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52882-mantisbt-authorization-bypass-in-rest-and-soap-apis)
- [MantisBT reflected XSS in admin/install.php](https://junglewise.ai/threats/cve-2026-52881-mantisbt-reflected-xss-in-admin-install-php)
- [MantisBT reflected XSS in admin/install.php](https://junglewise.ai/threats/cve-2026-52847-mantisbt-reflected-xss-in-admin-install-php)