MantisBT: master-2.28 016f1055

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master-2.28 2026-05-30 09:29 master-2.28 6b248809
Affected Issues  0037065: CVE-2026-52882: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Changeset

Prevent unauthorized update of version field

Users below report_issues_for_unreleased_versions_threshold should not
be allowed to set an Issue's product version to an unreleased one.

Added the necessary access check to prevent that.

Fixes 0037065, GHSA-3v2j-6fw9-f57c
mod - api/soap/mc_issue_api.php Diff File