GHSA-4vpf-w7qv-5h3q: MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
MantisBT versions prior to 2.28.4 contain a vulnerability in the mc_issue_update SOAP and REST API endpoints where the note_type parameter is not properly validated. This allows users with updater access to inject unauthorized TIME_TRACKING and REMINDER notes. Specifically, TIME_TRACKING notes can be used to inject fake billable hours, corrupting billing reports and potentially leading to incorrect invoicing and flawed project management decisions. REMINDER notes can be faked but do not trigger actual notifications. A patch addressing this issue is available in version 2.28.4.
AI Analysis
Technical Summary
The vulnerability in MantisBT's mc_issue_update SOAP and REST API endpoints arises from the lack of validation on the user-supplied note_type parameter. The SOAP endpoint passes this parameter directly to bugnote_add() without verifying if the user is authorized to create that note type. Users with access levels above the time tracking view threshold can inject arbitrary hours into billing reports via TIME_TRACKING notes (note_type=2). The REST API similarly allows injection of TIME_TRACKING notes but not REMINDER notes. This can corrupt billing data and project management reports. The issue is fixed in MantisBT version 2.28.4.
Potential Impact
An attacker with updater-level access can inject fraudulent billable hours into MantisBT's time tracking system, corrupting billing reports and potentially causing inaccurate client invoices and misguided project management decisions. Additionally, attackers can create fake REMINDER notes, though these do not result in actual notifications being sent.
Mitigation Recommendations
A fix is available in MantisBT version 2.28.4. Users and administrators should upgrade to version 2.28.4 or later to remediate this vulnerability. No workarounds are available. Until patched, restrict updater access to trusted users only.
GHSA-4vpf-w7qv-5h3q: MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
Description
MantisBT versions prior to 2.28.4 contain a vulnerability in the mc_issue_update SOAP and REST API endpoints where the note_type parameter is not properly validated. This allows users with updater access to inject unauthorized TIME_TRACKING and REMINDER notes. Specifically, TIME_TRACKING notes can be used to inject fake billable hours, corrupting billing reports and potentially leading to incorrect invoicing and flawed project management decisions. REMINDER notes can be faked but do not trigger actual notifications. A patch addressing this issue is available in version 2.28.4.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in MantisBT's mc_issue_update SOAP and REST API endpoints arises from the lack of validation on the user-supplied note_type parameter. The SOAP endpoint passes this parameter directly to bugnote_add() without verifying if the user is authorized to create that note type. Users with access levels above the time tracking view threshold can inject arbitrary hours into billing reports via TIME_TRACKING notes (note_type=2). The REST API similarly allows injection of TIME_TRACKING notes but not REMINDER notes. This can corrupt billing data and project management reports. The issue is fixed in MantisBT version 2.28.4.
Potential Impact
An attacker with updater-level access can inject fraudulent billable hours into MantisBT's time tracking system, corrupting billing reports and potentially causing inaccurate client invoices and misguided project management decisions. Additionally, attackers can create fake REMINDER notes, though these do not result in actual notifications being sent.
Mitigation Recommendations
A fix is available in MantisBT version 2.28.4. Users and administrators should upgrade to version 2.28.4 or later to remediate this vulnerability. No workarounds are available. Until patched, restrict updater access to trusted users only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4vpf-w7qv-5h3q
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52883"]
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a58b44368715ace43d6abda
Added to database: 07/16/2026, 10:36:51 UTC
Last enriched: 07/16/2026, 11:22:41 UTC
Last updated: 07/17/2026, 00:46:16 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.