-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient access checks in bug_actiongroup_ext.php when handling group actions. The patch specifically adds validation to filter the 'bug_arr[]' parameter by checking access rights for each issue, indicating the original code lacked these checks. The file path and parameter handling are explicitly referenced in both the vulnerability description and the associated fix commit. This matches the CWE-200 pattern of exposing sensitive data through missing authorization checks on direct object references (bug_arr[] parameter).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mantisbt/mantisbt | composer | <= 2.25.5 | 2.25.6 |
Ongoing coverage of React2Shell