In short
- CVE-2026-33052 is a MEDIUM (CVSS 5.3) vulnerability affecting mantisbt/mantisbt.
- Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.4% of all vulnerabilities.
- Fix: update to 2.28.2 or later.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.28.0, < 2.28.2
| 2.28.2
|
Description
MantisBT allows a low-privileged authenticated user having add_profile_threshold to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request.
Impact
Authentication bypass
Patches
- 3f952e68fa864e0e60abc3e84adecf3cfa84c75e
Workarounds
None
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issues.
NVD description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
More vulnerabilities in mantisbt/mantisbt
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free