CVE-2026-49280
MantisBT: REST API unauthorized Issue status change
A MantisBT user having $g_update_bug_threshold (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the $g_set_status_threshold config is set to a higher level (DEVELOPER by default).
Impact
Unauthorized change in Issue workflow.
Patches
https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4
Workarounds
None
Resources
Credits
Mamdouh Mahfouz (@mamdouhmahfouz)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-m7ph-9558-mrx3
MantisBT: REST API unauthorized Issue status change
A MantisBT user having $g_update_bug_threshold (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the $g_set_status_threshold config is set to a higher level (DEVELOPER by default).
Impact
Unauthorized change in Issue workflow.
Patches
https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4
Workarounds
None
Resources
Credits
Mamdouh Mahfouz (@mamdouhmahfouz)
- Record
GHSA-m7ph-9558-mrx3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-m7ph-9558-mrx3
MantisBT: REST API unauthorized Issue status change
A MantisBT user having $g_update_bug_threshold (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the $g_set_status_threshold config is set to a higher level (DEVELOPER by default).
Impact
Unauthorized change in Issue workflow.
Patches
https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4
Workarounds
None
Resources
Credits
Mamdouh Mahfouz (@mamdouhmahfouz)
- Record
GHSA-m7ph-9558-mrx3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mantisbt/mantisbtPackagist |
2.8.0 to 2.28.3 | 2.28.4 |
mantisbt/mantisbtPackagist |
2.8.0 up to 2.28.4, plus listed versions 2.10.02.10.12.11.02.11.12.12.0 Show 45 moreShow less2.12.12.12.22.13.02.13.12.13.22.14.02.15.02.15.12.16.02.16.12.17.02.17.12.17.22.18.02.18.12.19.02.19.12.20.02.20.12.21.02.21.12.21.22.21.32.22.02.22.12.22.22.23.02.23.12.24.02.24.12.24.22.24.32.24.42.24.52.25.02.25.12.25.22.25.32.25.42.25.52.25.62.25.72.25.82.26.02.26.1 |
2.28.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-49280 is a medium vulnerability (CVSS 5.3) in mantisbt/mantisbt, published July 15, 2026. No source lists public exploit code. Fixed in mantisbt/mantisbt 2.28.4.
References
Left out here: 14 versions. The JSON record has them.