View Issue Details

WikiJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0036503mantisbtbugtrackerpublic2025-10-16 12:382025-10-20 11:50
Reporterd3vpoo1 Assigned Todregad  
PrioritynormalSeverityminorReproducibilityhave not tried
Status assignedResolutionopen 
Product Version2.27.1 
Target Version2.27.2 
Summary0036503: Ability to change the default project of a user
Description

Hi,

The endpoint http://localhost/mantisbt/bug_report_page.php allows a user to modify the default project displayed on the tracker. During testing, I noticed that a private project can be set as the default project, but it only reflects on the admin side.

Steps To Reproduce
  1. As an admin, create one public project and one or two private projects.
  2. Create a reporter role.
  3. Add the reporter user to the public project.
  4. Log in as the reporter role.
  5. Navigate to the vulnerable component.
  6. Open Burp Suite.
  7. Select any project and click the “Make default” checkbox.
  8. Modify the project_id parameter and set it to a private project.
  9. Submit the request.
  10. Log in as the admin account and go to the Users section.
  11. Observe that the default project for that user is set to the private project.
TagsNo tags attached.
Attached Files
image.png (115,912 bytes)   
image.png (115,912 bytes)   
image-2.png (53,573 bytes)   
image-2.png (53,573 bytes)   
image-3.png (60,369 bytes)   
image-3.png (60,369 bytes)   
image-4.png (60,425 bytes)   
image-4.png (60,425 bytes)   
image-5.png (61,346 bytes)   
image-5.png (61,346 bytes)   
image-6.png (85,869 bytes)   
image-6.png (85,869 bytes)   

Activities

dregad

dregad

2025-10-20 09:42

developer   ~0070577

I confirm the behavior.

It should not be possible to change the default to a project the user does not have access to.

However, I cannot find any way to actually exploit this. It only creates an annoyance to the user, who will get an error (ERR_TOO_MANY_REDIRECTS) if they try to access bug_report_page.php while the current project is ALL_PROJECTS.
dregad

dregad

2025-10-20 10:37

developer   ~0070580

@d3vpoo1, I have not been able to change the default project for another user, only for the currently logged in user. In ~70569 you implied that it was possible (I can modify the default project of other user), did I miss something ?

As it stands, I would not qualify this as a security issue - just an insufficient access check with no real consequences. I don't think it's worth a CVE.
dregad

dregad

2025-10-20 11:07

developer   ~0070581

PR https://github.com/mantisbt/mantisbt/pull/2156
d3vpoo1

d3vpoo1

2025-10-20 11:32

reporter   ~0070583

Hi @dregad,

Thanks on this. I see, no issue with that one.

Btw is it ok to hide / set the 0036502:0070569 to private?
dregad

dregad

2025-10-20 11:50

developer   ~0070585

is it ok to hide / set the 0036502:0070569 to private?

It's possible, but why ? I don't see any confidential info there.