GitHub Advisoryadvisory · Packagist

GHSA-crmx-4p49-46m2 MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

MEDIUM Published 2026-05-11 Modified 2026-06-05 Official page ↗
Aliases
CVE-2026-34970
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2026-05-11

Affected packages

• Packagist mantisbt/mantisbt: < 2.28.2 → fixed in 2.28.2

Description

MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue. Impact Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure. Patches • 71df1f67e05b2050cd4bd87839e6cc13747cf03f Workarounds None Credits Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

Related

Alias · CVE (1)

  • CVE-2026-34970 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References