CVE-2026-52882Medium▾ SunlitMantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions.
None
MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.
mantisbt/mantisbt <= 2.28.3Upgrade to a patched release:
mantisbt/mantisbt 2.28.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52883MediumMantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs
CVE-2026-62944HighMantisBT: Stored XSS in print_all_bug_page_word.php
CVE-2026-52847CriticalMantisBT: Reflected XSS in admin/install.php
CVE-2026-52881CriticalMantisBT: Reflected XSS in admin/install.php via unescaped printf
CVE-2026-47156Critical· 9.3MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
CVE-2026-49273HighMantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php