En resumen
- CVE-2026-33052 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a mantisbt/mantisbt.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.34%, mayor que el 27.4% de las vulnerabilidades.
- Solución: actualizar a 2.28.2 o posterior.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.28.0, < 2.28.2
| 2.28.2
|
Description
MantisBT allows a low-privileged authenticated user having add_profile_threshold to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request.
Impact
Authentication bypass
Patches
- 3f952e68fa864e0e60abc3e84adecf3cfa84c75e
Workarounds
None
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issues.
NVD description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
Más vulnerabilidades de mantisbt/mantisbt
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free