Is mantisbt/mantisbt affected by CVE-2026-52882?

Packagist mantisbt/mantisbt is affected in <= 2.28.3.

Is CVE-2026-52882 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

medium

CVE-2026-52882

Q: Is CVE-2026-52882 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

Packagist · mantisbt/mantisbt

Summary

MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters

Severity: medium
CWE: CWE-639
Also known as: GHSA-3v2j-6fw9-f57c
Published: 2026-07-15
Updated: 2026-07-15

Advisory details

Impact

Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions.

Patches

https://github.com/mantisbt/mantisbt/commit/17072d4c322c85f7135ebec3417a6d90b525d12f

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37065

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

References

Related advisories

CVE-2026-47156 — critical · Packagist/mantisbt/mantisbt
CVE-2026-52881 — critical · Packagist/mantisbt/mantisbt
CVE-2026-52847 — critical · Packagist/mantisbt/mantisbt
CVE-2026-30849 — critical · Packagist/mantisbt/mantisbt
CVE-2026-62944 — high · Packagist/mantisbt/mantisbt
CVE-2026-49273 — high · Packagist/mantisbt/mantisbt
CVE-2026-47142 — high · Packagist/mantisbt/mantisbt
CVE-2026-44657 — high · Packagist/mantisbt/mantisbt

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.