Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2.
References
| Link | Resource |
|---|---|
| https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e | Patch |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr | Vendor Advisory Issue Tracking |
| https://mantisbt.org/bugs/view.php?id=36005 | Exploit Vendor Advisory Issue Tracking |
Configurations
History
10 Nov 2025, 18:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mantisbt/mantisbt/commit/21e9fbedde8553c29c0d3156e84f78157fc4f22e - Patch | |
| References | () https://github.com/mantisbt/mantisbt/security/advisories/GHSA-q747-c74m-69pr - Vendor Advisory, Issue Tracking | |
| References | () https://mantisbt.org/bugs/view.php?id=36005 - Exploit, Vendor Advisory, Issue Tracking | |
| CPE | cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* | |
| First Time |
Mantisbt mantisbt
Mantisbt |
04 Nov 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-04 21:15
Updated : 2025-11-10 18:02
NVD link : CVE-2025-55155
Mitre link : CVE-2025-55155
CVE.ORG link : CVE-2025-55155
JSON object : View
Products Affected
mantisbt
- mantisbt