CVE-2026-34754

Published: May 20, 2026Modified: Jul 24, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (3)

https://github.com/mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206

Source: security-advisories@github.com

https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwc

Source: security-advisories@github.com

https://mantisbt.org/bugs/view.php?id=36976

Source: security-advisories@github.com

Timeline

No history available yet.