Privilege Escalation in Mantis Bug Tracker Affects User Permissions

CVE-2026-34390

What is CVE-2026-34390?

The Mantis Bug Tracker application has a vulnerability that allows users with a manager access level to elevate their privileges and grant project-level administrator access to themselves or other users. This happens due to insufficient access control in the backend handler for project user management. Although this escalation might seem significant, the overall administrative capabilities remain limited, as it does not grant any additional privileges at the global instance level. This issue was resolved in version 2.28.2.

References