MantisBT unauthorized disclosure of private project column configuration
Impact
Due to insufficient access-level checks, any non-admin user having access to _manage_config_columns_page.php_ (typically project managers having MANAGER role) can use the _Copy From_ action to retrieve the columns configuration from a private project they have no access to.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.27.2Ecosystem versions | 2.27.2 |
Version evidence: OSV · GHSA-g582-8vwr-68h2
View original version evidence (72 explicit versions)
Original source description
Impact
Due to insufficient access-level checks, any non-admin user having access to manage_config_columns_page.php (typically project managers having MANAGER role) can use the Copy From action to retrieve the columns configuration from a private project they have no access to.
Access to the reverse operation (Copy To) is correctly controlled, i.e. it is not possible to alter the private project's configuration.
Patches
The vulnerability will be fixed in MantisBT version 2.27.2.
Workarounds
None
Credits
Thanks to d3vpoo1 for reporting the issue.
References
- Security advisory github.com/mantisbt/mantisbt/security/advisories/GHSA-g582-8vwr-68h2
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-62520
- Patch github.com/mantisbt/mantisbt/commit/4fe94f45fa2baea2aeb4b65781d2009e7b4a0bf3
- Source reference github.com/mantisbt/mantisbt
- Source reference mantisbt.org/bugs/view.php