Mantis Bug Tracker versions 2.28.0 and 2.28.1 contain an authorization bypass that allows a low‑privileged authenticated user with the add_profile_threshold permission to create a global profile by tampering with the user_id parameter in a profile creation request. Because global profiles affect system‑wide settings, an attacker can introduce or modify configuration values that apply to all users. The weakness is a classic authorization flaw (CWE‑639) and the impact is unauthorized configuration changes that can alter the behavior of the issue tracker for every user.

The affected product is Mantis Bug Tracker (MantisBT) provided by mantisbt. Vulnerable releases are 2.28.0 and 2.28.1. The issue is fixed in 2.28.2.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting a limited likelihood of exploitation. An attacker must first authenticate and possess the add_profile_threshold permission; by manipulating an HTTP request parameter they can create a global profile. While the attack requires privileged access within the system, the potential for widespread configuration changes warrants timely remediation.