MantisBT CVE-2026-42071 Privileged Attachment Enumeration via REST API

Vulnerability Overview MantisBT contains a security vulnerability (CVE-2026-42071) that allows low-privilege users to enumerate and retrieve the content of private bugnote attachments via the REST API, even when those attachments belong to invisible private bugnotes. Affected Scope Affected Version: MantisBT 2.28.1 Fixed Version: MantisBT 2.28.2 Affected Users: Any low-privilege user who can view public issues but cannot view private bugnotes. Remediation Fixed Version: Upgrade to MantisBT 2.28.2 or higher. Fix Details: - Modified the function in to ensure proper visibility checks on the bugnote to which the attachment belongs during enumeration. - Fixed the function to avoid unnecessary calls. - Fixed the function to ensure the correct parameter is passed when calling . POC Code Additional Information Reporter: mrinjasc Assigned to: dregad Priority: high Severity: minor Reproducibility: always Status: closed Resolution: fixed Related Changesets MantisBT: master-2.28 77d25d37 - Added parameter to the function. - Fixed the function to avoid unnecessary calls. MantisBT: master-2.28 5b7f5bc9 - Fixed the issue where private bugnote attachments were leaked via the REST API. - Added missing parameter to the call. MantisBT: master-2.28 955cb50f - Fixed the issue where private bugnote attachments were leaked via the SOAP API. - Fixed incomplete access checks in . Relations Related Issues: - 0027039: CVE-2025-15781: Access to private bug note attachments - 0037092: Private Bugnote Attachment Content Leak via REST API - 0037095: Private Bugnote Files Disclosure via REST API Get Issues File Or SOAP API mc_issue_attachment_get Activity dregad submitted the patch for CVE-2026-42071 and performed related testing. Tags None. Summary This vulnerability allows low-privilege users to retrieve the content of private bugnote attachments via the REST API, posing an information disclosure risk. It is recommended to upgrade to MantisBT 2.28.2 or higher as soon as possible to fix this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

MantisBT CVE-2026-42071 Privileged Attachment Enumeration via REST API