Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2.
References
| Link | Resource |
|---|---|
| https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e | Patch |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr | Issue Tracking Vendor Advisory |
| https://mantisbt.org/bugs/view.php?id=36005 | Exploit Issue Tracking Vendor Advisory |
Configurations
History
17 Jun 2026, 09:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr - Issue Tracking, Vendor Advisory | |
| References | () https://mantisbt.org/bugs/view.php?id=36005 - Exploit, Issue Tracking, Vendor Advisory |
10 Nov 2025, 18:02
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mantisbt mantisbt
Mantisbt |
|
| References | () https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e - Patch | |
| References | () https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr - Vendor Advisory, Issue Tracking | |
| References | () https://mantisbt.org/bugs/view.php?id=36005 - Exploit, Vendor Advisory, Issue Tracking | |
| CPE | cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* |
04 Nov 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-04 21:15
Updated : 2026-06-17 09:41
NVD link : CVE-2025-55155
Mitre link : CVE-2025-55155
CVE.ORG link : CVE-2025-55155
JSON object : View
Products Affected
mantisbt
- mantisbt