CVE-2026-42071: MantisBT: Private Bugnote Attachment Content Leak via REST API

Synopsis

A missing authorization check in Mantis Bug Tracker (MantisBT) versions 2.23.0 through 2.28.1 allows any authenticated user with Reporter-level access or higher to download file attachments on private bugnotes they are not permitted to view. The flaw is reachable over the network via the REST API endpoint GET /api/rest/issues/{id}/files and the SOAP API mc_issue_attachment_get endpoint, requiring only a valid low-privilege account with no additional interaction. Successful exploitation gives attackers read access to confidential attachment content, and limited write and availability impact is also present. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable REST and SOAP API endpoints are exposed over the network, so an attacker must be able to reach the MantisBT service remotely.

• AuthenticationRequired

  A valid MantisBT account at Reporter privilege level or above is required; any standard low-privilege account is sufficient to exploit this flaw.

• Victim interactionNot required

  The attacker makes direct API requests and does not need any action from another user to retrieve private bugnote attachments.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race condition, specific memory layout, or unusual environmental state is needed beyond possessing a valid account.

Blast Radius

• Reads the binary or text content of file attachments on private bugnotes that the attacker's account is not authorized to view, exposing confidential issue-tracking data.
• Gains limited write-side impact consistent with the VI:L token, such as minor manipulation of issue-related data reachable through the same API surface.
• Causes limited availability disruption consistent with the VA:L token, such as degraded responsiveness of the file-download API under repeated or abusive requests.
• Impact is contained to the MantisBT application itself; the CVSS SC:N/SI:N/SA:N tokens indicate no scope change into adjacent systems or infrastructure.