CVE-2026-33052

Medium

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.

SeverityMedium

CVSS5.3

Exploit probability—

ProductMantisbt/mantisbt

PublishedMay 19, 2026

First seenMay 19, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

mantisbt/mantisbt2.28.2 or later

Affected products

Product	Affected versions	Fixed in
mantisbt/mantisbtPackagist	2.28.0 ≤ v < 2.28.2	2.28.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.