~ / search / GHSA-g582-8vwr-68h2

GHSA-g582-8vwr-68h2

MantisBT unauthorized disclosure of private project column configuration

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-62520

Packages

EcosystemPackageAffectedFixed in
Packagist mantisbt/mantisbt < 2.27.2 2.27.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Due to insufficient access-level checks, any non-admin user having access to _manage_config_columns_page.php_ (typically project managers having MANAGER role) can use the _Copy From_ action to retrieve the columns configuration from a private project they have no access to. Access to the reverse operation (_Copy To_) is correctly controlled, i.e. it is not possible to alter the private project's configuration. ### Patches The vulnerability will be fixed in MantisBT version 2.27.2. ### Workarounds None ### Credits Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.

References

External links from the advisory. They lead to third-party sites.