MantisBT lacks verification when changing a user's email address

TRUNG BÌNH 5.4CVE-2025-55155 · GHSA-q747-c74m-69pr · Công bố 04/11/2025 · cập nhật 19/10/2026

Tóm tắt nhanh

CVE-2025-55155 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng mantisbt/mantisbt, mantisbt (mantisbt).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.16%, cao hơn 5.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.27.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
mantisbt/mantisbt Packagist	`< 2.27.2`	`2.27.2`
mantisbt mantisbt	`< 2.27.2`	`2.27.2`

Mô tả

When a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user.

Impact

This could result in storing an invalid email address, preventing the user from receiving system notifications.

Notifications sent to another person's email address could lead to information disclosure.

Patches

Fixed in 2.27.2.

Workarounds

None

Credits

Thanks to @ncrcs for discovering and reporting the issue.

Mô tả của NVD

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2.