[CRITICAL] MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

PKSA-cwyv-kt56-ndf5 CVE-2026-30849 GHSA-phrq-pc6r-f6gh

Affected version: <2.28.1

Reported by:
GitHub

[MEDIUM] MantisBT unauthorized disclosure of private project column configuration

PKSA-h3h3-9cvh-htmg CVE-2025-62520 GHSA-g582-8vwr-68h2

Affected version: <2.27.2

Reported by:
GitHub

[MEDIUM] MantisBT lacks verification when changing a user's email address

PKSA-983m-gpx4-ywx3 CVE-2025-55155 GHSA-q747-c74m-69pr

Affected version: <2.27.2

Reported by:
GitHub

[MEDIUM] MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length

PKSA-r8rw-8k4b-bvgz CVE-2025-46556 GHSA-r3jf-hm7q-qfw5

Affected version: <2.27.2

Reported by:
GitHub

[HIGH] MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

PKSA-gxs3-7yhj-kxf3 CVE-2025-47776 GHSA-4v8w-gg5j-ph37

Affected version: <2.27.2

Reported by:
GitHub