In breve
- CVE-2026-33052 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda mantisbt/mantisbt.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.34%, superiore al 27.4% delle vulnerabilità.
- Correzione: aggiornare a 2.28.2 o successiva.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.28.0, < 2.28.2
| 2.28.2
|
Description
MantisBT allows a low-privileged authenticated user having add_profile_threshold to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request.
Impact
Authentication bypass
Patches
- 3f952e68fa864e0e60abc3e84adecf3cfa84c75e
Workarounds
None
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issues.
NVD description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free