MantisBT Incorrect Authorization in bug_actiongroup_page.php
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated May 30, 2025
Description
Published by the National Vulnerability Database
Jan 29, 2021
Published to the GitHub Advisory Database
May 24, 2022
Last updated
May 30, 2025
Reviewed
May 30, 2025
An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bug_arr[]= in a crafted bug_actiongroup_page.php URL. (The target Issues can have Private view status, or belong to a private Project.)
References