MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API

Vulnerability

Description

CVE-2026-34754 is an authorization bypass vulnerability in MantisBT, an open-source bug tracker. The flaw resides in the REST API endpoint POST /api/rest/issues/{id}/files, which handles file uploads to existing issues. The permission check function file_allow_bug_upload() in core/file_api.php only verifies that the user meets the project-level upload_bug_file_threshold configuration, without checking whether the user has the necessary view_bug_threshold` to access the specific issue [2]. This means an authenticated user who is allowed to upload files to a project can attach files to any issue within that project, including private or restricted issues they are not authorized to view [1][2].

Exploitation

To exploit this vulnerability, an attacker must have a valid MantisBT account with file upload privileges for a given project (i.e., their access level meets the upload_bug_file_threshold). No other special privileges are required. The attacker can then send a POST request to the REST endpoint with the ID of a private issue they should not be able to access, and the server will accept the attachment [2]. The attack is performed over the network and does not require any user interaction [3].

Impact

Successful exploitation allows an attacker to upload arbitrary files to private issues, potentially leaking sensitive information if the uploaded files are later accessible or if the act of uploading reveals the existence of the private issue. The vulnerability primarily affects data confidentiality and integrity, as the attacker can add content to issues they should not be able to modify [3].

Mitigation

The MantisBT project has released a patch in commit b262b4d2835b81394d75356dead66e52a6275206 [4]. The fix modifies the file_allow_bug_upload() function to enforce issue-level access control for existing issues: it now calls access_has_bug_level() instead of access_has_project_level() when a bug ID is provided [2][4]. Users should update to a version containing this commit. No workarounds are available [1].