CVE-2025-62520: MantisBT unauthorized disclosure of private project column configuration

The security advisory states that the vulnerability is due to insufficient access-level checks when copying column configurations from a private project. The provided patch in commit 4fe94f45fa2baea2aeb4b65781d2009e7b4a0bf3 modifies the manage_columns_copy.php file. This file is responsible for handling the 'Copy From' action. The patch adds a crucial access check to verify that the user has at least 'MANAGER' privileges on the source project ($t_src_project_id) before allowing the configuration to be copied. The vulnerable code is not within a specific function but in the main execution flow of the manage_columns_copy.php script. Therefore, the script itself is the vulnerable component that would be seen in a runtime profile when the vulnerability is exploited.