https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T12:20:43.621356+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-221517 EUVD-2026-221517 2026-10-22T12:20:43.624593+00:00 EUVD-2026-221517 https://cve.radiocsirt.org/vuln/fkie_cve-2023-22476 fkie_cve-2023-22476 2026-10-22T12:20:43.624638+00:00

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds.

 https://cve.radiocsirt.org/vuln/ghsa-hf4x-6h87-hm79 GHSA-hf4x-6h87-hm79 — MantisBT may expose private issues' summaries to unauthorized users 2026-10-22T12:20:43.624690+00:00

Affected: Packagist: mantisbt/mantisbt

### Impact Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*.

### Patches The vulnerability has been fixed in MantisBT version 2.25.6.

### Workarounds None

### Credits Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.

### References - https://mantisbt.org/bugs/view.php?id=31086

 https://cve.radiocsirt.org/vuln/gsd-2023-22476 gsd-2023-22476 2026-10-22T12:20:43.624729+00:00 gsd-2023-22476