GHSA-ggw7-9675-6v4v
MantisBT has an authorization bypass in private issue monitoring
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | >= 2.26.1, < 2.28.2 | 2.28.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Using a crafted POST request to bug_monitor_add.php, a user with project-level access can add themselves as a monitor for a private issue they do not have access to. Despite displaying an Access Denied error, the application accepts the request and creates a monitor relationship for the private issue.
### Impact
Direct access to the private issue remains blocked, but the user will receive email notifications for updates, leading to disclosure of the private issue's metadata and content.
### Patches
- 0a93267deba445fb9d15250c16e6fdb1246ffa65
### Workarounds
None
### Credits
Thanks to Vishal Shukla for discovering and responsibly reporting the issue.
References
External links from the advisory. They lead to third-party sites.