---
id: CVE-2026-49280
aliases:
  - GHSA-m7ph-9558-mrx3
title: 'MantisBT: REST API unauthorized Issue status change'
summary: 'MantisBT: REST API unauthorized Issue status change'
severity: medium
cwe:
  - CWE-862
vendor: mantisbt
product: mantisbt/mantisbt
ecosystem: composer
affected:
  - 'mantisbt/mantisbt >= 2.8.0, <= 2.28.3'
patched:
  - mantisbt/mantisbt 2.28.4
published: '2026-07-15'
updated: '2026-07-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m7ph-9558-mrx3'
references:
  - url: >-
      https://github.com/mantisbt/mantisbt/security/advisories/GHSA-m7ph-9558-mrx3
  - url: >-
      https://github.com/mantisbt/mantisbt/commit/2d3a5537605487a1ec5178aba9fe9b5623b6a4e0
  - url: 'https://mantisbt.org/bugs/view.php?id=37181'
  - url: 'https://github.com/advisories/GHSA-m7ph-9558-mrx3'
tags:
  - ghsa
  - composer
ingestedAt: '2026-07-15T17:44:34.608Z'
---

## Overview

A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the *$g_set_status_threshold* config is set to a higher level (DEVELOPER by default).

### Impact
Unauthorized change in Issue workflow.

### Patches
https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4

### Workarounds
None

### Resources
- https://mantisbt.org/bugs/view.php?id=37181

### Credits
Mamdouh Mahfouz (@mamdouhmahfouz)

## Affected packages

- `mantisbt/mantisbt >= 2.8.0, <= 2.28.3`

## Remediation

Upgrade to a patched release:

- `mantisbt/mantisbt 2.28.4`