Summary
MantisBT: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Advisory details
Impact
Users below report_issues_for_unreleased_versions_threshold can assign unreleased product versions.
Patches
Workarounds
None
Resources
Credits
MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-63735
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
- MEDIUMCVE-2026-72802
SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
- MEDIUMCVE-2026-63669
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
- HIGHCVE-2026-73841
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
- MEDIUMCVE-2026-82395
Sulu: Media move/update authorization bypass (IDOR)
- HIGHCVE-2026-81892
EasyAdmin custom-action dispatcher bypasses access_control on other routes