MantisBT CVE-2025-62520: Privilege Escalation via Column Copy Function

Critical Vulnerability Information Vulnerability ID: 0036502 CVE Number: CVE-2025-62520 Vulnerability Description: Ability to copy private project configurations (columns) Affected Version: 2.27.2 Fixed Version: 2.27.2 GitHub Security Advisory: GHSA-g582-8wv-subtract Fix Commit: 4fe94f45 Reproduction Steps 1. As an administrator, create a private project and one or two public projects. 2. Navigate to and modify any column. 3. Create a Manager role. 4. Log in with the Manager role. 5. Navigate to . 6. Open Burp Suite. 7. Select a project from the dropdown menu and click the "Copy Columns from..." button. 8. This will invoke the endpoint. 9. Modify the other value and use the ID of the private project. 10. Submit the constructed request. 11. Observe that it copies columns from the private project. Handling Process Reporter: d3vpo01 Assigned To: atrol Fix Commit: Submitted by dregad, fixing the permission check issue when copying column settings. GitHub Security Advisory ID: GHSA-g582-8wvr-68h2 Additional Information MantisBT Version: 2.27.1 Related Issues: - 0009050: Add support for "Copy Columns from/to" when custom columns are used for viewing issues, printing issues, CSV, Excel, etc. - 0036515: In access level checks on the manage columns page, hard-coded roles were used instead of configured roles. Attached Files (158,318 bytes) (123,055 bytes) (65,340 bytes) (123,869 bytes) (67,141 bytes) (68,200 bytes) (161,352 bytes) (64,915 bytes) (64,915 bytes) (109,869 bytes) (57,699 bytes) (19,350 bytes)

Goal Reached Thanks to every supporter — we hit 100%!

MantisBT CVE-2025-62520: Privilege Escalation via Column Copy Function