Skip to content
OpenAdvisories
Medium CVE-2026-52882 GHSA-3v2j-6fw9-f57c

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

Published Jul 15, 2026 · Updated Jul 15, 2026 · Assigned by GHSA

Description

### Impact
Users below _report_issues_for_unreleased_versions_threshold_ can assign unreleased product versions.

### Patches
- https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f

### Workarounds
None

### Resources
- https://mantisbt.org/bugs/view.php?id=37065

### Credits
MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist mantisbt/mantisbt < 2.28.4 2.28.4 GHSA-3v2j-6fw9-f57c

References