CVE-2025-62520: MantisBT Authorization Bypass Vulnerability

CVE-2025-62520 Overview

CVE-2025-62520 is a broken access control vulnerability in Mantis Bug Tracker (MantisBT), an open source issue tracking system. In versions 2.27.1 and below, the manage_config_columns_page.php endpoint fails to enforce project-level authorization on the Copy From action. Any authenticated non-admin user can invoke this action to read the columns configuration from a private project they otherwise cannot access. The flaw is classified under CWE-285: Improper Authorization. MantisBT version 2.27.2 resolves the issue by adding a project-level access check to the copy handler.

Critical Impact
Authenticated low-privilege users can disclose column configuration metadata from private projects, exposing information about restricted project structures.

Affected Products

MantisBT versions 2.27.1 and earlier
Fixed in MantisBT version 2.27.2
Component: manage_columns_copy.php / manage_config_columns_page.php

Discovery Timeline

2025-11-04 - CVE-2025-62520 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62520

Vulnerability Analysis

MantisBT allows project administrators and managers to configure which columns are displayed on issue views for each project. The manage_config_columns_page.php interface offers a Copy From function that clones column configuration from a source project into the destination project. Prior to the fix, this action validated write access on the destination project but did not validate read access on the source project. As a result, any user with permission to reach the column management page could specify an arbitrary source project identifier, including private projects assigned to other teams, and receive the configured column set in the response. The disclosure is limited to column metadata but reveals structural details of restricted projects.

Root Cause

The root cause is a missing authorization check on the source project identifier passed to the copy handler. The code enforced access_ensure_project_level( MANAGER, $t_dst_project_id ) for the destination but performed no equivalent check for $t_src_project_id. Global defaults across projects were also readable without the MANAGER threshold on the source project.

Attack Vector

An authenticated user with access to the column management page sends a request to the copy endpoint with a src_project_id parameter pointing to a private project. The server processes the copy operation and returns column configuration for the target project without verifying membership. Exploitation requires low privileges and network access to the MantisBT instance, with no user interaction on the victim side.

php

 	access_ensure_project_level( MANAGER, $t_dst_project_id );
 }
 
+# only MANAGERS can read global defaults of a project
+if( $f_manage_page && $t_src_project_id != ALL_PROJECTS ) {
+	access_ensure_project_level( MANAGER, $t_src_project_id );
+}
+
 # user should only be able to set columns for a project that is accessible.
 if( $t_dst_project_id != ALL_PROJECTS ) {
 	access_ensure_project_level( config_get( 'view_bug_threshold', null, null, $t_dst_project_id ), $t_dst_project_id );

Source: GitHub Commit 4fe94f4. The patch adds access_ensure_project_level( MANAGER, $t_src_project_id ) so requests targeting a source project must satisfy the MANAGER threshold on that project.

Detection Methods for CVE-2025-62520

Indicators of Compromise

HTTP POST requests to manage_columns_copy.php with a src_project_id parameter referencing project IDs the requesting account is not a member of.
Repeated column copy requests from a single authenticated user enumerating sequential src_project_id values.
Access log entries where the same user account accesses manage_config_columns_page.php immediately followed by copy actions targeting multiple distinct source projects.

Detection Strategies

Correlate MantisBT web server access logs with user-to-project membership tables to flag copy actions where source projects are outside the caller's assigned projects.
Inspect application audit logs for manage_columns_copy.php invocations by users lacking MANAGER role on the referenced source project.
Deploy web application firewall rules that log or block src_project_id values referencing private projects when the session user lacks membership.

Monitoring Recommendations

Enable verbose logging on MantisBT administrative endpoints, including source and destination project identifiers on column copy operations.
Baseline expected administrative activity per user and alert on deviations that involve enumeration of project identifiers.
Forward MantisBT application and web server logs to a centralized analytics platform for cross-source correlation with authentication events.

How to Mitigate CVE-2025-62520

Immediate Actions Required

Upgrade MantisBT to version 2.27.2 or later, which enforces MANAGER-level access on the source project during column copy operations.
Audit historical access logs for suspicious calls to manage_columns_copy.php referencing private project identifiers.
Review MantisBT user role assignments and remove unnecessary access to column management pages for accounts that do not require it.

Patch Information

The fix is delivered in MantisBT 2.27.2 via commit 4fe94f4. Details are published in the GitHub Security Advisory GHSA-g582-8vwr-68h2 and tracked in the MantisBT Bug Report #36502. Administrators should apply the upgrade and validate that the copy action rejects unauthorized source project identifiers after deployment.

Workarounds

Restrict access to manage_config_columns_page.php and manage_columns_copy.php at the web server or reverse proxy layer to administrator IP ranges only until patching is complete.
Reduce the population of users granted permissions that expose the column management interface, limiting the exploitable audience.
Segment private projects into separate MantisBT instances where feasible to prevent cross-project disclosure through shared administrative endpoints.

bash

# Example nginx restriction limiting column management endpoints to trusted networks
location ~ ^/manage_(config_columns_page|columns_copy)\.php$ {
    allow 10.0.0.0/8;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}