Mantis Bug Tracker contains a flaw in the mc_issue_update() function. Users who can update bugs (the update_bug_threshold role, typically DEFAULT UPDATER) are permitted to edit the notes attached to other users’ bug reports, thus bypassing the stricter DEVELOPER level guard normally required by mc_issue_note_update(). This allows an attacker to alter existing notes, change their visibility state, or tamper with time-tracking fields on any bugnote they should not be able to influence, undermining the integrity of issue history.

Every installation of MantisBT with a version older than 2.28.2 is vulnerable. The issue exists in the core MantisBT product as distributed by mantisbt:mantisbt. Users granted the UPDATER privilege under the default role hierarchy can exploit the flaw, so systems that allow non-developer users to edit bugs are affected.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score is not available, making it difficult to gauge the current exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is an authenticated internal or internal‑authenticated user possessing UPDATE_BUG_THRESHOLD access, who would invoke the Issue Update API to reach the vulnerable endpoint. Such a user could modify or delete bugnotes, corrupt project records, and potentially erode stakeholder trust.