MantisBT CVE-2026-42070: REST/SOAP mc_issue_update Bypasses Note-Level Authorization

Vulnerability Overview Vulnerability ID: 0037089 Project Name: mantisbt Category: security Status: public Submission Date: 2026-04-18 17:26 Last Update: 2026-05-09 19:56 Reporter: nmjsec Assigned To: dregad Priority: normal Severity: major Reproducibility: always State: closed Resolution: fixed Product Version: 2.28.1 Target Version: 2.28.2 Fixed Version: 2.28.2 Description CVE-2026-42070: REST/SOAP mc_issue_update Embedded Note Update Bypasses Note-Level Authorization accepts a array. When the array contains an referencing an existing visible note, the function performs three direct database operations without enforcing the corresponding access control thresholds: 1. (line 1160): Missing check for . The default threshold is DEVELOPER (55). An UPDATER (40) can modify the text of any visible note. 2. (line 1195): Missing check for / . The default threshold is UPDATER (40). However, also checks (DEVELOPER) for notes owned by other users. 3. (line 1200): Missing check for the feature flag and . The only check applied before reaching the note update branch is (issue-level, default UPDATER (40)), which is lower than (note-level, default DEVELOPER (55)). Relevant code in : Reproduction Steps Prerequisites: An authenticated user has access permissions for (UPDATER) but not for (DEVELOPER). Note 5 was created by another user. Observation: Note 5's text is modified, privacy is switched to private, and time tracking is updated—even though the UPDATER lacks , , or permissions. Additional Information Severity: Medium Type: Authorization bypass / missing access control Affected Code: - (embedded note update branch) - REST: (delegates to ) Impact: - An UPDATER (level 40) cannot bypass note-level authorization to edit other users' notes via the web interface or out-of-band note endpoints. - The same request allows toggling note privacy and updating time tracking data without appropriate per-note thresholds. Remediation Fixed Version: 2.28.2 Fix Details: - Adds note-level permission checks in to ensure the user is authorized to update each note. - Fixes CVE-2026-42070 - Modified File: Relations Duplicates: 0037093 (closed, dregad) Authorization Bypass in Bugnote Editing via Issue Update API Activity dregad (2026-04-19 19:41): Advisory https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pq86-j2c2-47f6 created, CVE request sent. dregad (2026-04-24 13:06): The same patch allows toggling note privacy. By default, changing view state from public to private is possible, but to make a private note public the UPDATER user also needs to have private_bugnote_threshold (which is not the case by default). calls , which only returns bugnotes the UPDATER user has access to, excluding other users' private notes. dregad (2026-04-28 12:31): CVE-2026-42070 assigned dregad (2026-05-02 05:40): @nmjsec: Patch is ready for review, https://github.com/mantisbt/mantisbt/pull/4, looking forward to receiving your feedback. Related Changesets MantisBT: master-2.28 6e58fae4 - Committer: dregad - Date: 2026-05-06 19:33 - Commit Message: Fix Bugnote update auth bypass via REST/SOAP API - Affected Issues: 0037089 - Details: - Add a note-level permission check in to ensure the user is authorized to update each bugnote individually. - Fixes 0037089, GHSA-pq86-j2c2-47f6 / CVE-2026-42070 - Modified File:

Goal Reached Thanks to every supporter — we hit 100%!

MantisBT CVE-2026-42070: REST/SOAP mc_issue_update Bypasses Note-Level Authorization