Kurz gesagt
- CVE-2026-33052 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in mantisbt/mantisbt.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.34%, höher als bei 27.4% aller Schwachstellen.
- Abhilfe: auf 2.28.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.28.0, < 2.28.2
| 2.28.2
|
Description
MantisBT allows a low-privileged authenticated user having add_profile_threshold to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request.
Impact
Authentication bypass
Patches
- 3f952e68fa864e0e60abc3e84adecf3cfa84c75e
Workarounds
None
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issues.
NVD description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free