5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34970

CVE-2026-34970: MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This issue has been fixed in version 2.28.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34970

CVE-2026-34970:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	<= 2.28.1	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the access_can_view_bugnote_revisions function within core/access_api.php. The original implementation of this function failed to verify whether the user retained access to the parent bug associated with a bugnote. It only checked if the user was the bugnote's reporter or had a certain privilege level for viewing revisions. This oversight allowed a scenario where a user, after losing access to a private bug, could still access the revision history of a bugnote attached to it. This access would leak sensitive information, specifically the private bug's ID and summary. The provided patch addresses this by introducing a crucial access check for the parent bug at the beginning of the function, ensuring that the user has the necessary permissions before any bugnote revision information is displayed.

Vulnerable functions

access_can_view_bugnote_revisions

core/access_api.php

The function `access_can_view_bugnote_revisions` in `core/access_api.php` was vulnerable because it did not check if a user had access to the parent bug before allowing them to view bugnote revisions. An attacker who previously had access to a private issue could still access the bugnote revision page after their access was revoked, leading to the disclosure of the private issue's ID and summary. The patch added a check to ensure the user has access to the parent bug.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.