GitHub Advisoryadvisory · Packagist

GHSA-q747-c74m-69pr MantisBT lacks verification when changing a user's email address

MEDIUM Published 2025-11-03 Modified 2025-11-04 Official page ↗
Aliases
CVE-2025-55155
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-201, CWE-345
Reviewed
2025-11-03

Affected packages

• Packagist mantisbt/mantisbt: < 2.27.2 → fixed in 2.27.2

Description

When a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. Impact This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. Patches Fixed in 2.27.2. Workarounds None Credits Thanks to @ncrcs for discovering and reporting the issue.

Related

Alias · CVE (1)

  • CVE-2025-55155 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability

Weakness · CWE (2)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness

References