MantisBT: master-2.28 0ac87c39

Diff Back to Repository
Author Committer Branch Timestamp Parent
dregad dregad master-2.28 2026-05-30 09:35 master-2.28 016f1055
Affected Issues  0037065: CVE-2026-52882: REST and SOAP API Issue Update Accepts Unreleased Product Versions From Updaters
Changeset

Prevent unauthorized update of version field (2)

Users below report_issues_for_unreleased_versions_threshold should not
be allowed to set an Issue's product version to an unreleased one.

This addresses the problem in the MantisBT UI - users could send a
crafted request to bug_report.php or bug_update.php

Added the necessary access checks to prevent that.

Fixes 0037065, GHSA-3v2j-6fw9-f57c
mod - bug_update.php Diff File
mod - core/commands/IssueAddCommand.php Diff File