CVE-2026-49280 json
MantisBT: REST API unauthorized Issue status change
published 2026-07-15 3 mo ago modified 2026-07-15 3 mo ago also GHSA-m7ph-9558-mrx3
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the *$g_set_status_threshold* config is set to a higher level (DEVELOPER by default).
### Impact Unauthorized change in Issue workflow.
### Patches https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4
### Workarounds None
### Resources - https://mantisbt.org/bugs/view.php?id=37181
### Credits Mamdouh Mahfouz (@mamdouhmahfouz)
Patch / fix
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mantisbt/mantisbt | >=2.8.0, <2.28.4 |
2.28.4 |
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
Sources
- GitHub Advisory GHSA-m7ph-9558-mrx3
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.