CVE-2026-34754

FAUCET Score

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

First published: May 19, 2026Last modified: May 19, 2026

Impacted Technologies

Vendor	Product	Version(s)	CPE
Mantisbt	Mantisbt	< 2.28.2CNA affected

CVSS Data

CVSS version used by this source: 3.1

4.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

1.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.25%

Probability of exploitation in next 30 days

EPSS Percentile

16.2%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0025 is in the 19th percentile among its peer group of 21,977 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

composerpatch availablevia ghsa

Product: mantisbt/mantisbtFixed in: 2.28.2

Vendor Advisories (1)

composerGHSA-h4x5-gvx6-3rwcmedium

MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API

May 11, 2026

References

github.com / mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206

github.com / mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwc

mantisbt.org / bugs/view.php