CVE-2025-62520: MantisBT unauthorized disclosure of private project column configuration
Impact
Due to insufficient access-level checks, any non-admin user having access to manageconfigcolumnspage.php (typically project managers having MANAGER role) can use the Copy From action to retrieve the columns configuration from a private project they have no access to.
Access to the reverse operation (Copy To) is correctly controlled, i.e. it is not possible to alter the private project's configuration.
Patches The vulnerability will be fixed in MantisBT version 2.27.2.
Workarounds None
Credits Thanks to d3vpoo1 for reporting the issue.
Other sources
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manageconfigcolumnspage.php can use the Copy From action to retrieve the columns configuration from a private project they have no access to. This issue is fixed in version 2.27.2.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62520?
CVE-2025-62520 is considered a high severity vulnerability due to its potential for unauthorized data access.
How do I fix CVE-2025-62520?
To mitigate CVE-2025-62520, it is essential to update MantisBT to version 2.27.3 or later where the vulnerability is addressed.
Who is affected by CVE-2025-62520?
CVE-2025-62520 affects any non-admin users, typically with the MANAGER role, who can access the manage_config_columns_page.php.
What type of vulnerability is CVE-2025-62520?
CVE-2025-62520 is an access control vulnerability enabling unauthorized retrieval of configuration data.
What software versions are impacted by CVE-2025-62520?
CVE-2025-62520 affects MantisBT versions prior to 2.27.3.