Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-34970 EUVD-2026-31005GHSA-crmx-4p49-46m2

MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

Published May 19, 2026 · Updated May 20, 2026 · Assigned by GitHub_M

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This issue has been fixed in version 2.28.2.

Affected products

VendorProductAffectedFixed
mantisbt mantisbt < 2.28.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist mantisbt/mantisbt < 2.28.2 2.28.2 GHSA-crmx-4p49-46m2

References