CVE-2026-52882

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

5.3 MediumFix available

Impact

Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions.

Patches

https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37065

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

What each source reports

GitHub Advisories Score usedGHSA-3v2j-6fw9-f57c 5.3

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

Impact

Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions.

Patches

https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37065

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

Record: GHSA-3v2j-6fw9-f57c
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-639
Updated: 2026-11-02

OSVGHSA-3v2j-6fw9-f57c 5.3

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

Impact

Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions.

Patches

https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37065

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

Record: GHSA-3v2j-6fw9-f57c
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-639
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`mantisbt/mantisbt` Packagist	through 2.28.3	2.28.4
`mantisbt/mantisbt` Packagist	before 2.28.4, plus listed versions 2.10.02.10.12.11.02.11.12.12.0 Show 45 moreShow less 2.12.12.12.22.13.02.13.12.13.22.14.02.15.02.15.12.16.02.16.12.17.02.17.12.17.22.18.02.18.12.19.02.19.12.20.02.20.12.21.02.21.12.21.22.21.32.22.02.22.12.22.22.23.02.23.12.24.02.24.12.24.22.24.32.24.42.24.52.25.02.25.12.25.22.25.32.25.42.25.52.25.62.25.72.25.82.26.02.26.1	2.28.4

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-52882 is a medium vulnerability (CVSS 5.3) in mantisbt/mantisbt, published July 15, 2026. No source lists public exploit code. Fixed in mantisbt/mantisbt 2.28.4.

References

This page doesn't list everything

Left out here: 28 versions. The JSON record has them.