MantisBT unauthorized disclosure of private project column configuration

中 4.3CVE-2025-62520 · GHSA-g582-8vwr-68h2 · 04/11/2025 公開 · 19/10/2026 更新

要点

CVE-2025-62520 は mantisbt/mantisbt, mantisbt (mantisbt) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.26%（全脆弱性の 18.3% より高い）。
対処：2.27.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
mantisbt/mantisbt Packagist	`< 2.27.2`	`2.27.2`
mantisbt mantisbt	`< 2.27.2`	`2.27.2`

概要

Impact

Due to insufficient access-level checks, any non-admin user having access to manage_config_columns_page.php (typically project managers having MANAGER role) can use the Copy From action to retrieve the columns configuration from a private project they have no access to.

Access to the reverse operation (Copy To) is correctly controlled, i.e. it is not possible to alter the private project's configuration.

Patches

The vulnerability will be fixed in MantisBT version 2.27.2.

Workarounds

None

Credits

Thanks to d3vpoo1 for reporting the issue.

NVD の説明

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.