Medium severity · published May 19, 2026
CVE-2026-34970
MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow a bugnote author to access the note's Revisions page after losing access to the parent private issue. This issue has been fixed in version 2.28.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mantisbt · mantisbt
< 2.28.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34970
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34970
github.com
https://github.com/mantisbt/mantisbt/commit/71df1f67e05b2050cd4bd87839e6cc13747cf03f
github.com
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-crmx-4p49-46m2
mantisbt.org
https://mantisbt.org/bugs/view.php?id=36978
More from mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php