MantisBT unauthorized disclosure of private project column configuration

In MantisBT versions 2.27.1 and below, the manage_config_columns_page.php page lacks proper access-level verification when performing a "Copy From" action. This oversight allows any non-admin user who has access to this page (typically users with MANAGER role) to retrieve the columns configuration from any private project, even if they are not a member of that project [1][4].

The attack surface is limited to users who can reach manage_config_columns_page.php, which is typically granted to project managers. By using the "Copy From" function, an attacker can select any project as the source, including private projects they should not be able to read. The copy operation is performed server-side without checking the user's access to the source project [2]. Notably, the reverse "Copy To" operation correctly enforces access controls, so the vulnerability only allows reading, not writing, of configuration data.

The impact is the disclosure of a private project's column configuration, which could reveal sensitive information about how that project organizes its bug tracker, including custom fields or workflow details. An attacker could use this information to gain insights into the structure and processes of restricted projects [4].

The vulnerability was fixed in MantisBT version 2.27.2 via commit [2]. Users are strongly advised to upgrade to this version or later. No workaround is available [4]. The issue was reported by d3vpoo1 [4].