GHSA-q747-c74m-69pr

Suggest an improvement
Source
https://github.com/advisories/GHSA-q747-c74m-69pr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-q747-c74m-69pr/GHSA-q747-c74m-69pr.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-q747-c74m-69pr
Aliases
Published
2025-11-03T20:12:18Z
Modified
2025-11-04T22:31:08.568812Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
MantisBT lacks verification when changing a user's email address
Details

When a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user.

Impact

This could result in storing an invalid email address, preventing the user from receiving system notifications.

Notifications sent to another person's email address could lead to information disclosure.

Patches

Fixed in 2.27.2.

Workarounds

None

Credits

Thanks to @ncrcs for discovering and reporting the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-201",
        "CWE-345"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2025-11-04T21:15:39Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2025-11-03T20:12:18Z"
}
References

Affected packages

Packagist / mantisbt/mantisbt

Package

Name
mantisbt/mantisbt
Purl
pkg:composer/mantisbt/mantisbt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.27.2

Affected versions

2.*

2.3.0
2.3.1
2.3.2
2.3.3
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.9.0
2.9.1
2.10.0
2.10.1
2.11.0
2.11.1
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.13.2
2.14.0
2.15.0
2.15.1
2.16.0
2.16.1
2.17.0
2.17.1
2.17.2
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.20.1
2.21.0
2.21.1
2.21.2
2.21.3
2.22.0
2.22.1
2.22.2
2.23.0
2.23.1
2.24.0
2.24.1
2.24.2
2.24.3
2.24.4
2.24.5
2.25.0
2.25.1
2.25.2
2.25.3
2.25.4
2.25.5
2.25.6
2.25.7
2.25.8
2.26.0
2.26.1
2.26.2
2.26.3
2.26.4
2.27.0
2.27.1