Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-33052: MantisBT lets low‑privileged users create global profiles
CVE-2026-33052 · published 5 months ago
Summary
In MantisBT version 2.28.0 and 2.28.1, a user with only the "add_profile_threshold" right can trick the system into creating a global profile, even though they lack the "manage_global_profile_threshold" permission. This could let unauthorized users change settings that affect all users. Upgrade to version 2.28.2 or later to close the gap.
What to do
- Update mantisbt mantisbt to version 2.28.2.
- Update mantisbt mantisbt/mantisbt to version 2.28.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | mantisbt | mantisbt |
>= 2.28.0, < 2.28.2 Fix: upgrade to 2.28.2
|
| Packagist | mantisbt | mantisbt/mantisbt |
>= 2.28.0, < 2.28.2 Fix: upgrade to 2.28.2
|
Original advisory text
MantisBT: Authorization Bypass in Global Profile Creation
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
References
- https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.2
- https://github.com/advisories/GHSA-68w5-w573-q2r8
- https://github.com/mantisbt/mantisbt Product
- https://mantisbt.org/bugs/view.php?id=36974 URL
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-68w5-w573-q2r8 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33052 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33052... Vendor Advisory
- https://github.com/mantisbt/mantisbt/commit/3f952e68fa864e0e60abc3e84adecf3cfa84... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published19 May 2026
Updated4 Nov 2026
First seen11 May 2026
Sources
GHSA-68w5-w573-q2r8 · GHSA
CVE-2026-33052 · NVD
GHSA-68w5-w573-q2r8 · OSV
CVE-2026-33052 · OSV
Track software like this
Free during beta