CVE-2026-49280

mediumcovered by 1 sourcefirst seen 2026-07-15

A MantisBT user having *$g_update_bug_threshold* (UPDATER by default) can change an Issue's Status via REST and SOAP API, even if the *$g_set_status_threshold* config is set to a higher level (DEVELOPER by default). Impact Unauthorized change in Issue workflow. Patches https://github.com/mantisbt/mantisbt/releases/tag/release-2.28.4 Workarounds None Resources - https://mantisbt.org/bugs/view.php?id=37181 Credits Mamdouh Mahfouz (@mamdouhmahfouz)

⚡ Watch CVE-2026-49280

Get an email if CVE-2026-49280 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumGHSA-m7ph-9558-mrx3: MantisBT: REST API unauthorized Issue status changeghsa · 2026-07-15

External references

NVD record for CVE-2026-49280

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-49280 status](https://www.csirts.com/badge/CVE-2026-49280)](https://www.csirts.com/cve/CVE-2026-49280)