CVE-2026-33052 — MantisBT: Authorization Bypass in Global Profile Creation
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permissi…
Published: 2026-05-19 · CVSS: 5.3 · CVSS 4.0
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user assigned the "add_profile_threshold" permission to create a global profile despite not having manage_global_profile_threshold, by tampering with the user_id parameter in a valid profile creation request. This issue has been fixed in version 2.28.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7