CVE-2026-52882 json
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
published 2026-07-15 3 mo ago modified 2026-07-15 3 mo ago also GHSA-3v2j-6fw9-f57c
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
### Impact Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions.
### Patches - https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f
### Workarounds None
### Resources - https://mantisbt.org/bugs/view.php?id=37065
### Credits MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.
Patch / fix
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mantisbt/mantisbt | <2.28.4 |
2.28.4 |
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
Sources
- GitHub Advisory GHSA-3v2j-6fw9-f57c
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.