Executive brief
MantisBT is a popular open-source bug tracking system. A security flaw allows users with basic project access to bypass security restrictions and monitor private issues they are not authorized to see. While they cannot view the issue directly on the website, they will receive email notifications containing the private issue's details and updates, potentially exposing sensitive project information.
Technical details
An authorization bypass exists in bug_monitor_add.php due to improper validation of POST requests. An attacker with low-privileged project access can submit a crafted request to monitor a private issue; although the application returns an 'Access Denied' error, it still processes the request and establishes the monitoring relationship. While direct web access to the issue remains restricted, the attacker successfully triggers the notification system, receiving sensitive metadata and content via email. This vulnerability is addressed in version 2.28.2.
Affected products
- MantisBT MantisBT >= 2.26.1, <= 2.28.1
Timeline
- 2026-05-09: disclosed
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-19: other: NVD published