GHSA-3v2j-6fw9-f57cMedium

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

Published
July 15, 2026
Last Modified
July 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-52882 →

📋 Description

Impact

Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions.

Patches

  • https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f

Workarounds

None

Resources

  • https://mantisbt.org/bugs/view.php?id=37065

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

🎯 Affected products1

  • composer/mantisbt/mantisbt:<= 2.28.3

🔗 References (4)