MantisBT allows a bugnote author to access the bugnote revision page after losing access to the parent private issue, disclosing issue metadata such as the issue id and summary.

The revision page authorization permits a bugnote reporter to access bugnote revisions even when the user no longer has access to the parent issue. Although the page does not disclose the full revision body in the tested setup, it still renders issue-level metadata from the private issue.

/bug_revision_view_page.php?bugnote_id=9

The revision page returned 200 OK and exposed:

• page title: 0000002: test - MantisBT
• heading: View Revisions: Note 9
• issue summary block: 0000002: test

This is a metadata disclosure because the issue itself remained inaccessible.

Affected Code

• access_api.php:985
• bug_revision_view_page.php:102
• bug_revision_view_page.php:198

Root Cause
access_can_view_bugnote_revisions() permits access for the bugnote reporter:
return $t_has_access || bugnote_is_user_reporter( $p_bugnote_id, $t_user_id );