CVE-2026-33052

The vulnerability is an authorization bypass in the profile creation handler of Mantis Bug Tracker (MantisBT). The intended permission model distinguishes between personal profile creation, controlled by the add_profile_threshold permission, and global profile management, controlled by the manage_global_profile_threshold permission [1]. In vulnerable versions 2.28.0 and 2.28.1, the file account_prof_update.php at line 72 only performs a permission check for personal profiles when the user_id parameter is not equal to ALL_USERS (defined as 0). If an attacker submits user_id=0, the check is skipped entirely, and profile_create() is called directly with that user ID [4].

Exploitation requires a low-privileged authenticated user who has been granted the add_profile_threshold permission (e.g., a REPORTER role) [4]. The attacker does not need any additional privileges or special network position—a standard web request to the profile update page with a tampered user_id parameter is sufficient [1]. The attack vector is network-based, and no complex conditions or target-specific customization are required [1].

A successful exploit allows the attacker to create a global profile that is visible to all users, bypassing the manage_global_profile_threshold permission which should be required for such operations [4]. This can lead to unauthorized modification of shared configuration data within the MantisBT installation, potentially impacting all users of the system.

The vulnerability has been fixed in MantisBT version 2.28.2 [3]. Users are strongly advised to upgrade immediately, as no workaround is mentioned in the advisories. The fix ensures that the proper authorization check is performed regardless of the user_id value [4].