https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T11:17:41.051259+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-28527 cnvd-2025-28527 2026-10-12T11:17:41.083386+00:00 cnvd-2025-28527 https://cve.radiocsirt.org/vuln/euvd-2026-260112 EUVD-2026-260112 2026-10-12T11:17:41.083420+00:00 EUVD-2026-260112 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62520 fkie_cve-2025-62520 2026-10-12T11:17:41.083434+00:00

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.

 https://cve.radiocsirt.org/vuln/ghsa-g582-8vwr-68h2 GHSA-g582-8vwr-68h2 — MantisBT unauthorized disclosure of private project column configuration 2026-10-12T11:17:41.083464+00:00

Affected: Packagist: mantisbt/mantisbt

### Impact

Due to insufficient access-level checks, any non-admin user having access to _manage_config_columns_page.php_ (typically project managers having MANAGER role) can use the _Copy From_ action to retrieve the columns configuration from a private project they have no access to.

Access to the reverse operation (_Copy To_) is correctly controlled, i.e. it is not possible to alter the private project's configuration.

### Patches The vulnerability will be fixed in MantisBT version 2.27.2.

### Workarounds None

### Credits Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.