GHSA-crmx-4p49-46m2Medium

MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

Published
May 11, 2026
Last Modified
June 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-34970 →

📋 Description

MantisBT allows a bugnote author to access the note's Revisions page after losing access to the parent private issue.

Impact

Disclosure of the private Issue's Id and Summary. The bugnote full revision body remains secure.

Patches

  • 71df1f67e05b2050cd4bd87839e6cc13747cf03f

Workarounds

None

Credits

Thanks to Vishal Shukla for discovering and responsibly reporting the issue.

🎯 Affected products1

  • composer/mantisbt/mantisbt:<= 2.28.1

🔗 References (5)