요약
- CVE-2026-33052은(는) mantisbt/mantisbt에 영향을 주는 보통 (CVSS 5.3) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.34%, 전체 취약점의 27.4%보다 높음.
- 조치: 2.28.2 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.28.0, < 2.28.2
| 2.28.2
|
Description
MantisBT allows a low-privileged authenticated user having add_profile_threshold to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request.
Impact
Authentication bypass
Patches
- 3f952e68fa864e0e60abc3e84adecf3cfa84c75e
Workarounds
None
Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issues.
NVD description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free