CVE-2026-52883
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note_type integer directly to bugnote_add() without validating that the user is authorized to create that type of note. If the user's access level is higher than $g_time_tracking_view_threshold, they can also inject arbitrary hours into billing reports.
REST API also allows injection of TIME_TRACKING notes (but not REMINDER) through the same mc_issue_update() function.
Impact
An attacker with UPDATER access could:
- Inject fake billable hours via TIME_TRACKING notes (note_type=2), corrupting billing data exported through MantisBT's billing reports. Organizations that bill clients based on MantisBT time tracking data would generate incorrect invoices, and corrupt time tracking reports could be used to drive project management decisions.
- Fake REMINDER notes registered (but without actual sending of notifications).
Patches
Workarounds
None
Resources
Credits
Thanks to the following security researchers for discovering and responsibly reporting the issue
- Vishal Shukla
- Psalms Christopher Matovu (@byteoverride)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-4vpf-w7qv-5h3q
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note_type integer directly to bugnote_add() without validating that the user is authorized to create that type of note. If the user's access level is higher than $g_time_tracking_view_threshold, they can also inject arbitrary hours into billing reports.
REST API also allows injection of TIME_TRACKING notes (but not REMINDER) through the same mc_issue_update() function.
Impact
An attacker with UPDATER access could:
- Inject fake billable hours via TIME_TRACKING notes (note_type=2), corrupting billing data exported through MantisBT's billing reports. Organizations that bill clients based on MantisBT time tracking data would generate incorrect invoices, and corrupt time tracking reports could be used to drive project management decisions.
- Fake REMINDER notes registered (but without actual sending of notifications).
Patches
Workarounds
None
Resources
Credits
Thanks to the following security researchers for discovering and responsibly reporting the issue
- Vishal Shukla
- Psalms Christopher Matovu (@byteoverride)
- Record
GHSA-4vpf-w7qv-5h3q- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-4vpf-w7qv-5h3q
MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note_type integer directly to bugnote_add() without validating that the user is authorized to create that type of note. If the user's access level is higher than $g_time_tracking_view_threshold, they can also inject arbitrary hours into billing reports.
REST API also allows injection of TIME_TRACKING notes (but not REMINDER) through the same mc_issue_update() function.
Impact
An attacker with UPDATER access could:
- Inject fake billable hours via TIME_TRACKING notes (note_type=2), corrupting billing data exported through MantisBT's billing reports. Organizations that bill clients based on MantisBT time tracking data would generate incorrect invoices, and corrupt time tracking reports could be used to drive project management decisions.
- Fake REMINDER notes registered (but without actual sending of notifications).
Patches
Workarounds
None
Resources
Credits
Thanks to the following security researchers for discovering and responsibly reporting the issue
- Vishal Shukla
- Psalms Christopher Matovu (@byteoverride)
- Record
GHSA-4vpf-w7qv-5h3q- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mantisbt/mantisbtPackagist |
through 2.28.3 | 2.28.4 |
mantisbt/mantisbtPackagist |
before 2.28.4, plus listed versions 2.10.02.10.12.11.02.11.12.12.0 Show 45 moreShow less2.12.12.12.22.13.02.13.12.13.22.14.02.15.02.15.12.16.02.16.12.17.02.17.12.17.22.18.02.18.12.19.02.19.12.20.02.20.12.21.02.21.12.21.22.21.32.22.02.22.12.22.22.23.02.23.12.24.02.24.12.24.22.24.32.24.42.24.52.25.02.25.12.25.22.25.32.25.42.25.52.25.62.25.72.25.82.26.02.26.1 |
2.28.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-52883 is a medium vulnerability (CVSS 5.3) in mantisbt/mantisbt, published July 15, 2026. No source lists public exploit code. Fixed in mantisbt/mantisbt 2.28.4.
References
Left out here: 28 versions. The JSON record has them.