GHSA-q747-c74m-69pr
MantisBT lacks verification when changing a user's email address
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | < 2.27.2 | 2.27.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
When a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user.
### Impact
This could result in storing an invalid email address, preventing the user from receiving system notifications.
Notifications sent to another person's email address could lead to information disclosure.
### Patches
Fixed in 2.27.2.
### Workarounds
None
### Credits
Thanks to @ncrcs for discovering and reporting the issue.
References
External links from the advisory. They lead to third-party sites.