Most recent entries from all

cnvd-2025-28527

EUVD-2026-260112

fkie_cve-2025-62520

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.

GHSA-g582-8vwr-68h2 — MantisBT unauthorized disclosure of private project column configuration

Affected: Packagist: mantisbt/mantisbt

### Impact

Due to insufficient access-level checks, any non-admin user having access to _manage_config_columns_page.php_ (typically project managers having MANAGER role) can use the _Copy From_ action to retrieve the columns configuration from a private project they have no access to.

Access to the reverse operation (_Copy To_) is correctly controlled, i.e. it is not possible to alter the private project's configuration.

### Patches The vulnerability will be fixed in MantisBT version 2.27.2.

### Workarounds None

### Credits Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.