GHSA-4v8w-gg5j-ph37
Critical · 9.1CVSS
9.1
EPSS
—
Published
Nov 3, 2025
CISA due date
—
The record
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | mantisbt/mantisbt | 0 | 2.27.2 |
Related vulnerabilities
- CVE-2025-47776 MantisBT: Authentication bypass for some passwords due to PHP type juggling Same vulnerability
- CVE-2025-62520 MantisBT unauthorized disclosure of private project column configuration Also affects mantisbt/mantisbt
- CVE-2025-55155 MantisBT: Authentication bypass for some passwords due to PHP type juggling Also affects mantisbt/mantisbt
- CVE-2025-46556 MantisBT is Vulnerable to Denial-of-Service (DoS) attack via Excessive Note Length Also affects mantisbt/mantisbt
- GHSA-g582-8vwr-68h2 MantisBT unauthorized disclosure of private project column configuration Also affects mantisbt/mantisbt
- GHSA-q747-c74m-69pr MantisBT lacks verification when changing a user's email address Also affects mantisbt/mantisbt
- GHSA-r3jf-hm7q-qfw5 MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length Also affects mantisbt/mantisbt
- CVE-2017-7615 MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access… Also affects mantisbt/mantisbt