5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42070

CVE-2026-42070: MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API

The mc_issue_update() function in MantisBT allows users having update_bug_threshold access (UPDATER, with default settings) to edit, change view state, and modify time tracking on bugnotes belonging to other users — bypassing the default DEVELOPER (level 55) threshold required by the dedicated mc_issue_note_update() function.

Impact

UPDATER can edit notes by DEVELOPER/MANAGER/ADMIN — bypassing the DEVELOPER threshold
UPDATER can change private notes to public — exposing confidential internal discussion
UPDATER can change public notes to private — hiding information from reporters/viewers

Patches

6e58fae4f22efdc3987f903c8ba2611de17a9435

Workarounds

None

Credits

Thanks to the following security researchers for independently discovering and responsibly reporting the issue.

Vishal Shukla
Tristan Madani (@TristanInSec) from Talence Security

This advisory's contents was largely copied from Tristan's well-written report.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42070

CVE-2026-42070:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	<= 2.28.1	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, allows users with lower privileges to edit bug notes they do not own through the mc_issue_update API function. The provided patch 6e58fae4f22efdc3987f903c8ba2611de17a9435 directly modifies the mc_issue_update function in api/soap/mc_issue_api.php. The changes involve adding explicit authorization checks for each bug note being updated within an issue. Specifically, the patch adds logic to retrieve the user's permissions (update_bugnote_threshold and bugnote_user_edit_threshold) and then, within the loop that processes notes, it checks if the user has the required access level to modify each note using access_has_bugnote_level(). If the check fails, it returns an access denied error. This confirms that the mc_issue_update function was the source of the vulnerability, as it was missing these critical, granular permission checks, leading to an authorization bypass.

Vulnerable functions

mc_issue_update

api/soap/mc_issue_api.php

The `mc_issue_update` function in `api/soap/mc_issue_api.php` was vulnerable to an authorization bypass. Before the patch, this function did not perform adequate permission checks when updating bug notes (`bugnotes`). It allowed users with 'UPDATER' privileges to modify notes they did not own, which should have required 'DEVELOPER' privileges. The patch introduces a note-level permission check within the function by using `access_has_bugnote_level()` to ensure the user has the correct permissions to edit each individual note.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.