CVE-2024-34080: MantisBT Information Disclosure Vulnerability

CVE-2024-34080 Overview

CVE-2024-34080 is an information disclosure vulnerability in MantisBT (Mantis Bug Tracker), an open source issue tracker. When an issue references a bugnote belonging to another issue the user cannot access, MantisBT still renders the reference as a hyperlink. Although clicking the link returns an access denied error, the link itself, its label, and its tooltip expose sensitive metadata. Disclosed information includes the existence of the note, the note author name, the note creation timestamp, and the parent issue ID. The flaw is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. Version 2.26.2 contains the fix, and no workarounds exist.

Critical Impact
Unauthenticated or low-privileged users can enumerate the existence of private bugnotes, along with author identity, timestamps, and associated issue IDs across projects they should not access.

Affected Products

MantisBT versions prior to 2.26.2
Deployments referencing cross-issue bugnotes with private view state
Instances using the private_bugnote_threshold access control

Discovery Timeline

2024-05-14 - CVE-2024-34080 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34080

Vulnerability Analysis

The vulnerability resides in MantisBT's string processing logic that transforms bugnote references (for example, ~12345) into clickable hyperlinks. The code checked access permissions before returning a hyperlink, but the check compared the current user's access level against private_bugnote_threshold on the target project rather than verifying whether the user could view the parent issue.

When the note was public or the user matched a legacy criterion, the link was rendered with a tooltip containing the note author name, creation timestamp, and issue ID. Users hitting the link received an access denied error, yet the metadata had already been disclosed via the rendered HTML. This allowed silent enumeration of restricted content across projects.

Root Cause

The root cause is an incomplete authorization check in core/string_api.php. The original logic set $g_project_override to the target bug's project and evaluated private_bugnote_threshold, but never confirmed that the current user had view_bug_threshold access to the parent issue itself. As a result, hyperlink rendering leaked metadata about issues the user was not authorized to view.

Attack Vector

Exploitation requires network access to a MantisBT instance and the ability to view any issue that references a bugnote from a restricted issue. An attacker with a low-privilege account (or any user viewing a crafted note referencing ~<id> tokens) can observe the rendered tooltip and link text to harvest metadata without triggering an authorization failure until the click event.

php

// Security patch in core/string_api.php
// Fix access level check for note links
if( bugnote_exists( $c_bugnote_id ) ) {
    $t_bug_id = bugnote_get_field( $c_bugnote_id, 'bug_id' );
    if( bug_exists( $t_bug_id ) ) {
        $t_project_id = bug_get_field( $t_bug_id, 'project_id' );
        $t_user_id = auth_get_current_user_id();

        $g_project_override = $t_project_id;

        // New: verify the user can view the parent issue first
        $t_can_view_issue = access_has_bug_level(
            config_get( 'view_bug_threshold' ), $t_bug_id, $t_user_id );
        if( $t_can_view_issue ) {
            $t_can_view_note = access_compare_level(
                user_get_access_level( $t_user_id, $t_project_id ),
                config_get( 'private_bugnote_threshold' )
            );
            // ... render link only if both checks pass
        }
    }
}

Source: MantisBT commit 0a50562

Detection Methods for CVE-2024-34080

Indicators of Compromise

Access log entries showing repeated GET requests to view.php or bug_view_page.php returning access denied responses immediately after page loads containing rendered note tooltips.
Anomalous scraping patterns targeting endpoints that render issue descriptions or bugnotes with embedded ~<bugnote_id> references.
MantisBT installations reporting a version string prior to 2.26.2 in HTTP responses or the admin footer.

Detection Strategies

Inventory MantisBT deployments and flag any instance with a version earlier than 2.26.2 as vulnerable.
Review web access logs for high-volume enumeration of sequential bugnote or issue IDs from a single authenticated session.
Correlate access-denied responses on note view endpoints with prior successful renders of pages containing note references.

Monitoring Recommendations

Enable verbose MantisBT audit logging and forward events to a centralized SIEM for query and retention.
Alert on user sessions producing an unusual ratio of access-denied responses to successful bug views.
Monitor the mantis_bugnote_table for cross-project reference patterns that may indicate probing.

How to Mitigate CVE-2024-34080

Immediate Actions Required

Upgrade all MantisBT instances to version 2.26.2 or later immediately.
Audit historical access logs for reconnaissance patterns targeting bugnote references across restricted projects.
Restrict network exposure of MantisBT admin and issue-view endpoints to trusted networks where feasible.

Patch Information

MantisBT released the fix in version 2.26.2. The patched code is available in commit 0a50562 and was merged via Pull Request #2000. Full advisory details are documented in GitHub Security Advisory GHSA-99jc-wqmr-ff2q and MantisBT Bug Report #34434.

Workarounds

No official workarounds exist per the vendor advisory; upgrading to 2.26.2 is the only supported remediation.
As a compensating control, limit cross-project bugnote references by tightening private_bugnote_threshold and view_bug_threshold configuration values.
Reduce the population of authenticated users on shared MantisBT instances until patching is complete.

bash

# Verify installed MantisBT version and upgrade
grep "define( 'MANTIS_VERSION'" /path/to/mantisbt/core/constant_inc.php

# Fetch and deploy patched release 2.26.2
wget https://github.com/mantisbt/mantisbt/archive/refs/tags/2.26.2.tar.gz
tar -xzf 2.26.2.tar.gz
# Backup configuration, then replace application files and run the upgrade script:
#   php admin/install.php