GitHub Advisoryadvisory · Packagist
GHSA-g582-8vwr-68h2 MantisBT unauthorized disclosure of private project column configuration
MEDIUM
Official page ↗
- Aliases
- CVE-2025-62520
- Ecosystem
- Packagist
- Packages
- mantisbt/mantisbt
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-285
- Reviewed
- 2025-11-03
Affected packages
• Packagist mantisbt/mantisbt: < 2.27.2 → fixed in 2.27.2
Description
Impact
Due to insufficient access-level checks, any non-admin user having access to _manage_config_columns_page.php_ (typically project managers having MANAGER role) can use the _Copy From_ action to retrieve the columns configuration from a private project they have no access to.
Access to the reverse operation (_Copy To_) is correctly controlled, i.e. it is not possible to alter the private project's configuration.
Patches
The vulnerability will be fixed in MantisBT version 2.27.2.
Workarounds
None
Credits
Thanks to d3vpoo1 for reporting the issue.
Related
Alias · CVE (1)
- CVE-2025-62520 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability
Weakness · CWE (1)
- CWE-285 Improper Authorization weakness
References
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-g582-8vwr-68h2 web
- https://nvd.nist.gov/vuln/detail/CVE-2025-62520 advisory
- https://github.com/mantisbt/mantisbt/commit/4fe94f45fa2baea2aeb4b65781d2009e7b4a0bf3 web
- https://github.com/mantisbt/mantisbt package
- https://mantisbt.org/bugs/view.php?id=36502 web