GHSA-q747-c74m-69pr: MantisBT lacks verification when changing a user's email address

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2025-55155

MantisBT lacks verification when changing a user’s email address

Moderate severity GitHub Reviewed Published Nov 1, 2025 in mantisbt/mantisbt • Updated Nov 3, 2025

Package

composer mantisbt/mantisbt (Composer)

Affected versions

< 2.27.2

When a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user.

Impact

This could result in storing an invalid email address, preventing the user from receiving system notifications.

Notifications sent to another person’s email address could lead to information disclosure.

Patches

Fixed in 2.27.2.

Workarounds

None

Credits

Thanks to @ncrcs for discovering and reporting the issue.

References

• GHSA-q747-c74m-69pr
• mantisbt/mantisbt@21e9fbe
• https://mantisbt.org/bugs/view.php?id=36005

Published to the GitHub Advisory Database

Nov 3, 2025