GHSA-rmp5-5jj7-gmvf

MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-34744

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	mantisbt/mantisbt	< 2.28.2	2.28.2

Details

As written in the advisory (Markdown source, shown as plain text).

MantisBT permits a user to list and download their own attachments from an Issue created by another user, even after that Issue becomes private and direct access to it is denied. ### Impact The loss of confidentiality caused by this vulnerability is minimal, considering that only the attachments that were previously uploaded by the user themselves remains accessible. ### Patches - de7bdeec36de066235e38a77bf056917d951c84d ### Workarounds None. ### Credits Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mantisbt/mantisbt/security/advisories/GHSA-rmp5-5jj7-gmvf web
https://nvd.nist.gov/vuln/detail/CVE-2026-34744 advisory
https://github.com/mantisbt/mantisbt/commit/de7bdeec36de066235e38a77bf056917d951c84d web
https://github.com/mantisbt/mantisbt package
https://mantisbt.org/bugs/view.php?id=36977 web