https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 11:37:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-221517 EUVD-2026-221517 https://cve.radiocsirt.org/vuln/euvd-2026-221517 https://cve.radiocsirt.org/vuln/fkie_cve-2023-22476 <p>Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds.</p> <p>Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-22476 https://cve.radiocsirt.org/vuln/ghsa-hf4x-6h87-hm79 <p><strong>Affected:</strong> Packagist: mantisbt/mantisbt</p> <p>### Impact Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*.</p> <p>### Patches The vulnerability has been fixed in MantisBT version 2.25.6.</p> <p>### Workarounds None</p> <p>### Credits Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.</p> <p>### References - https://mantisbt.org/bugs/view.php?id=31086</p> <p><strong>Affected:</strong> Packagist: mantisbt/mantisbt</p> <p>### Impact Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*.</p> <p>### Patches The vulnerability has been fixed in MantisBT version 2.25.6.</p> <p>### Workarounds None</p> <p>### Credits Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.</p> <p>### References - https://mantisbt.org/bugs/view.php?id=31086</p> https://cve.radiocsirt.org/vuln/ghsa-hf4x-6h87-hm79 https://cve.radiocsirt.org/vuln/gsd-2023-22476 gsd-2023-22476 https://cve.radiocsirt.org/vuln/gsd-2023-22476