High severity · published May 22, 2026
CVE-2026-40596
MantisBT is vulnerable to XSS and potential account takeover via user font family preference update
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mantisbt · mantisbt
>= 2.11.0, < 2.28.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40596
github.com
https://github.com/mantisbt/mantisbt/commit/9e8409cdd979eba86ef532756fc47c1d8112d22d
github.com
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3
github.com
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j3v9-553h-x28j
mantisbt.org
https://mantisbt.org/bugs/view.php?id=37011
mantisbt.org
https://mantisbt.org/bugs/view.php?id=37016
More from mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php