5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55155

CVE-2025-55155: MantisBT lacks verification when changing a user's email address

When a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user.

Impact

This could result in storing an invalid email address, preventing the user from receiving system notifications.

Notifications sent to another person's email address could lead to information disclosure.

Patches

Fixed in 2.27.2.

Workarounds

None

Credits

Thanks to @ncrcs for discovering and reporting the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55155

CVE-2025-55155:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	< 2.27.2	2.27.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a user to change their email address to one they do not control, as the system does not perform any verification of ownership. This could lead to information disclosure through system notifications being sent to an incorrect address.

The analysis of the patch commit 21e9fbedde8553c29c0d3156e84f78157fc4f22e reveals that the core of the vulnerability was the direct update of the user's email in the database without a verification step. This was possible through two main code paths:

Web Interface: A user editing their profile via account_page.php would trigger a POST request to account_update.php. This script would then call the user_set_email() function. The original implementation of user_set_email() in core/user_api.php is considered vulnerable because it updated the email address after only performing basic validation checks (like format and uniqueness), but not ownership. It was the final function that committed the unverified email to the database.
API/Command Layer: The UserUpdateCommand class in core/commands/UserUpdateCommand.php provided another way to update user data. Its process() method would call a private update_user() method, which directly constructed and executed an UPDATE SQL query. This method was vulnerable as it blindly updated the email field with the provided data.

The patch rectifies this by introducing a token-based email verification flow. Instead of updating the email directly, the system now sends a verification link to the new email address. The update is only completed when the user clicks this link. This new logic was implemented in both the web (account_update.php) and command (UserUpdateCommand) flows, replacing the direct, unsafe updates.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.4

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-55155: MantisBT lacks verification when changing a user's email address

Impact

Patches

Workarounds

Credits

CVE-2025-55155:

5.4

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5.4

5.4

Technical Details

CVE-2025-55155: MantisBT lacks verification when changing a user's email address

Impact

Patches

Workarounds

Credits

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI