Medium severityGHSA Advisory· Published May 19, 2026· Updated May 20, 2026

CVE-2026-34744

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior permit a user to list and download their own attachments from an Issue created by another user even after it becomes private, bypassing read access revocation. The loss of confidentiality caused by this vulnerability is minimal, considering that only attachments previously uploaded by the user themselves remain accessible. This issue has been fixed in version 2.82.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mantisbt/mantisbtPackagist	< 2.28.2	2.28.2

Affected products

Mantisbt/MantisbtGHSA
Range: <= 2.28.1
ghsa-coords
pkg:composer/mantisbt/mantisbt
Range: < 2.28.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-rmp5-5jj7-gmvfghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-34744ghsaADVISORY
github.com/mantisbt/mantisbt/commit/de7bdeec36de066235e38a77bf056917d951c84dnvdWEB
github.com/mantisbt/mantisbt/security/advisories/GHSA-rmp5-5jj7-gmvfnvdWEB
mantisbt.org/bugs/view.phpnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000