CVE-2026-40596

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40596
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40596.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40596
Aliases
Related
Published
2026-05-22T19:25:32.812Z
Modified
2026-07-08T08:05:11.061840633Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L CVSS Calculator
Summary
MantisBT is vulnerable to XSS and potential account takeover via user font family preference update
Details

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40596.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/mantisbt/mantisbt

Affected ranges

Type
GIT
Repo
https://github.com/mantisbt/mantisbt
Events
Introduced
992c4787d84570e82e50ea05a05510f5023505a3
Fixed
399605af5f5c7640a2cf6b551409d9e37c5b4b7b
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.11.0"
        },
        {
            "fixed": "2.28.2"
        }
    ]
}

Affected versions

release-2.*
release-2.11.0
release-2.12.0
release-2.13.0
release-2.14.0
release-2.15.0
release-2.16.0
release-2.17.0
release-2.18.0
release-2.19.0
release-2.20.0
release-2.21.0
release-2.22.0
release-2.23.0
release-2.24.0
release-2.25.0
release-2.26.0
release-2.27.0
release-2.28.0
release-2.28.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40596.json"