GHSA-m7ph-9558-mrx3: MantisBT: REST API unauthorized Issue status change
MantisBT versions from 2.8.0 up to but not including 2.28.4 contain a vulnerability where a user with the update bug threshold permission (UPDATER by default) can change an issue's status via the REST and SOAP APIs, even if the configuration requires a higher permission level (DEVELOPER by default) to set status. This leads to unauthorized changes in the issue workflow.
AI Analysis
Technical Summary
In MantisBT, a user possessing the $g_update_bug_threshold permission can change an issue's status through REST and SOAP APIs despite the $g_set_status_threshold configuration being set to a higher permission level. This discrepancy allows users with lower privileges than intended to alter issue statuses, violating intended access controls. The vulnerability affects versions >=2.8.0 and <2.28.4. A fix was released in version 2.28.4. No workarounds are available.
Potential Impact
Unauthorized users with update permissions can change issue statuses, potentially disrupting issue workflows and tracking integrity. This could lead to confusion or misuse of the issue management process but does not directly affect system confidentiality, integrity beyond issue status, or availability.
Mitigation Recommendations
Upgrade MantisBT to version 2.28.4 or later, where this issue is fixed. No workarounds are available. Applying the official patch is the recommended remediation.
GHSA-m7ph-9558-mrx3: MantisBT: REST API unauthorized Issue status change
Description
MantisBT versions from 2.8.0 up to but not including 2.28.4 contain a vulnerability where a user with the update bug threshold permission (UPDATER by default) can change an issue's status via the REST and SOAP APIs, even if the configuration requires a higher permission level (DEVELOPER by default) to set status. This leads to unauthorized changes in the issue workflow.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In MantisBT, a user possessing the $g_update_bug_threshold permission can change an issue's status through REST and SOAP APIs despite the $g_set_status_threshold configuration being set to a higher permission level. This discrepancy allows users with lower privileges than intended to alter issue statuses, violating intended access controls. The vulnerability affects versions >=2.8.0 and <2.28.4. A fix was released in version 2.28.4. No workarounds are available.
Potential Impact
Unauthorized users with update permissions can change issue statuses, potentially disrupting issue workflows and tracking integrity. This could lead to confusion or misuse of the issue management process but does not directly affect system confidentiality, integrity beyond issue status, or availability.
Mitigation Recommendations
Upgrade MantisBT to version 2.28.4 or later, where this issue is fixed. No workarounds are available. Applying the official patch is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m7ph-9558-mrx3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49280"]
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a58b51668715ace43db3b0e
Added to database: 07/16/2026, 10:40:22 UTC
Last enriched: 07/16/2026, 14:27:55 UTC
Last updated: 07/16/2026, 14:27:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.