CVE-2025-55155: MantisBT Information Disclosure Vulnerability

CVE-2025-55155 Overview

Mantis Bug Tracker (MantisBT) is an open source issue tracker used by development teams to manage bugs and project workflows. CVE-2025-55155 affects MantisBT versions 2.27.1 and earlier, where the profile editor saves a user-supplied email address without verifying ownership. An authenticated user can change their account email to any address, including one belonging to another person, without proving control of that inbox. The flaw is classified as [CWE-201] Insertion of Sensitive Information Into Sent Data. System notifications routed to an attacker-controlled or unrelated inbox can leak issue data, user activity, and other project details. The issue is fixed in MantisBT 2.27.2.

Critical Impact
Authenticated users can set an unverified email address on their account, redirecting MantisBT notifications to arbitrary recipients and exposing issue-tracker content.

Affected Products

MantisBT versions 2.27.1 and earlier
MantisBT 2.x branch prior to 2.27.2
Self-hosted MantisBT deployments exposing the profile editor to authenticated users

Discovery Timeline

2025-11-04 - CVE-2025-55155 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2025-55155

Vulnerability Analysis

The vulnerability lives in the account management flow handled by account_page.php and account_update.php. When a user submits a new email address, MantisBT writes the value directly to the user record. The application performs no out-of-band confirmation that the user controls the mailbox. An attacker with any valid account can therefore associate their profile with another person's email address.

MantisBT dispatches notifications for issue updates, password resets, and account events to the stored address. Once the new value is persisted, every subsequent notification for that account is delivered to the chosen inbox. The result is targeted information disclosure of issue content, user activity, and reset tokens tied to the attacker's own session.

Root Cause

The root cause is missing verification of a user-controlled identifier before trusting it for notification routing. The profile update path lacked the token-issuing and confirmation step required to prove inbox ownership. The patch introduces use of tokens_api.php to issue a confirmation token and defers the email change until the new address is verified.

Attack Vector

Exploitation requires an authenticated low-privilege account on the target MantisBT instance. The attacker navigates to the profile page and submits an email address they do not own. MantisBT accepts the value and begins routing notifications to that address. No user interaction from the victim is required, and the attack is executed entirely over the network.

php

// Patch excerpt - account_update.php now includes tokens_api.php
 * @uses lang_api.php
 * @uses print_api.php
 * @uses string_api.php
+ * @uses tokens_api.php
 * @uses user_api.php
 * @uses utility_api.php

Source: GitHub commit 21e9fbe

The fix adds the token API dependency so that an email change triggers a verification token, closing the trust gap in the original flow.

Detection Methods for CVE-2025-55155

Indicators of Compromise

Audit log entries showing email field changes on user profiles without a corresponding verification event
Notification delivery logs sending messages for one user to a domain unrelated to the organization
Password reset emails or issue notifications bouncing or being reported by non-users
Multiple accounts configured with the same external email address

Detection Strategies

Query the MantisBT mantis_user_table for recent email column modifications and correlate against authentication logs
Monitor outbound SMTP relay logs for notification traffic to free-mail or unexpected external domains
Review GitHub Security Advisory GHSA-q747-c74m-69pr for vendor guidance on affected behavior

Monitoring Recommendations

Alert on any email change on administrator or project-manager accounts
Baseline the volume of notifications sent to each recipient domain and flag deviations
Capture web server access logs for repeated POST requests to account_update.php from the same session

How to Mitigate CVE-2025-55155

Immediate Actions Required

Upgrade MantisBT to version 2.27.2 or later
Audit all user accounts for recently modified email addresses and reset those that cannot be validated
Rotate any password reset tokens or session cookies issued after suspicious email changes
Restrict profile edit access to trusted networks until the upgrade is applied

Patch Information

MantisBT 2.27.2 resolves the issue by requiring email verification before the new address replaces the existing one. The fix is implemented in GitHub commit 21e9fbe and tracked in MantisBT bug #36005. Full details are published in the GitHub Security Advisory GHSA-q747-c74m-69pr.

Workarounds

Disable self-service email changes by restricting the profile page via web server access control
Require administrator review before applying any email change through operational process
Place MantisBT behind an authenticating reverse proxy to limit exposure of the profile editor

bash

# Example: block direct access to account_update.php at the reverse proxy
# nginx snippet - allow only admin IPs to submit profile changes
location = /account_update.php {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://mantisbt_upstream;
}