7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42071

CVE-2026-42071: MantisBT has a Private Bugnote Attachment Content Leak via REST API

A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint.

Impact

REPORTER (access level 25) can view file attachments that were uploaded to private bugnotes by DEVELOPER/MANAGER/ADMIN users
Private bugnotes are intended for internal developer discussion; their attachments (logs, screenshots, patches) should be equally protected
The web UI is NOT affected — it filters through bugnote_get_all_visible_bugnotes() first

Patches

029d9d203d9e4ae96b3e59d552fa7395cc1e5071

Workarounds

None

Credits

Thanks to the following security researchers for independently discovering and responsibly reporting the issue.

Vishal Shukla
Tristan Madani (@TristanInSec) from Talence Security
Tang Cheuk Hei (@siunam321)

This advisory's contents was largely copied from Tristan's well-written report.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42071

CVE-2026-42071:

7.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	>= 2.23.0, <= 2.28.1	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a missing authorization check within MantisBT, allowing authenticated users to access attachments on private bug notes that they should not have permission to view. The analysis of the provided patch (029d9d203d9e4ae96b3e59d552fa7395cc1e5071) reveals the exact locations of this flaw.

The root cause is that the functions responsible for checking file download permissions did not properly consider the privacy status of the bugnote associated with the attachment. This was addressed by modifying the core permission-checking functions to include the bugnote's context in the authorization decision.

The investigation of the patch identified two key vulnerable functions:

mci_file_get in api/soap/mc_file_api.php: This function, part of the SOAP API, had a weak permission check that was replaced with a more robust one. The patch removes the flawed mci_file_can_download_bug_attachments function and instead calls the patched file_can_download_bugnote_attachments function, ensuring that bugnote privacy is respected.
file_can_download_bugnote_attachments in core/file_api.php: This is a core function used for checking download permissions for bugnote attachments. The original implementation was flawed as it did not use the bug's context to determine if the bugnote was private. The patch rectifies this by adding the bug ID to the function's parameters and incorporating it into the permission check.

While the vulnerability description also mentions a REST API endpoint, the provided patch primarily shows changes related to the SOAP API and core functions. It is highly probable that the REST API also relies on the vulnerable file_can_download_bugnote_attachments function, and thus the patch to this core function remediates the vulnerability in both APIs.

Vulnerable functions

mci_file_get

api/soap/mc_file_api.php

This function, which is part of the SOAP API, was vulnerable because it did not properly check if a user had the right to access an attachment on a private bugnote. The patch adds a check for bugnote-level permissions, which was previously missing.

file_can_download_bugnote_attachments

core/file_api.php

This core function was vulnerable because it did not take the bug's context into account when determining if a bugnote attachment could be downloaded. This allowed an attacker to bypass privacy settings. The patch fixes this by requiring the bug ID to be passed and using it in the permission check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.