CVE-2026-34390

Insufficient access control checks in ProjectUsersAddCommand (used in manage_proj_user_add.php and REST API endpoint PUT /project/{id}/users) allows users having manage_project_threshold access level (manager by default) to grant project-level administrator access to any user (including themselves) in any Project they have manager rights in.

The normal project-user add form does restrict the selectable access levels to the actor's own project role or below. However, the backend handler still accepts a forged higher access_level value and writes it.

Workarounds

None

Credits

Thanks to the following security researchers for independently discovering and responsibly reporting the issue:

• Dracosec Research Limited (Siu Nam Tang, Chris Chan, Krecendo Hui, William Lam)
• Vishal Shukla

Privilege escalation.

The consequences of the privilege escalation are not as bad as it may sound, because having administrator access at Project level is effectively not very different from being manager, it does not actually give administrator privileges on the whole MantisBT instance. In particular, it does not let the upgraded user delete the Project or grant them any access to global administrative functions such as managing Users, Projects, Plugins, Custom Fields, etc.

Kodem intelligence

• 69e0180f180ed5acf48a8d281a73683a7bf32461

1. What is CVE-2026-34390? CVE-2026-34390 is a medium-severity security vulnerability in mantisbt/mantisbt (composer), affecting versions <= 2.28.1. It is fixed in 2.28.2.
2. Which versions of mantisbt/mantisbt are affected by CVE-2026-34390? mantisbt/mantisbt (composer) versions <= 2.28.1 is affected.
3. Is there a fix for CVE-2026-34390? Yes. CVE-2026-34390 is fixed in 2.28.2. Upgrade to this version or later.
4. Is CVE-2026-34390 exploitable, and should I be worried? Whether CVE-2026-34390 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-34390 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-34390? Upgrade mantisbt/mantisbt to 2.28.2 or later.