MantisBT allows a low-privileged authenticated user to create a global profile by tampering with the user_id parameter in a valid profile creation request.

The intended permission model distinguishes between:

• personal profile creation, controlled by add_profile_threshold
• global profile management, controlled by manage_global_profile_threshold

In the vulnerable add handler, account_prof_update.php:72 only applies the personal-profile permission check when user_id != ALL_USERS. If an attacker submits user_id = ALL_USERS, the handler skips that branch and calls profile_create() directly.

In this build, ALL_USERS is 0, defined in core/constant_inc.php:184.

As a result, a user who is allowed to create their own profile, such as REPORTER, can create a global profile without having manage_global_profile_threshold.

Affected Code

• account_prof_update.php:72
• core/constant_inc.php:184
• account_prof_menu_page.php:66
• manage_prof_menu_page.php:1
• config_defaults_inc.php:4898
• config_defaults_inc.php:4905

Root Cause

The vulnerable logic is:

$t_user_id = gpc_get_int( 'user_id' );

if( ALL_USERS != $t_user_id ) {
$t_user_id = auth_get_current_user_id();
access_ensure_global_level( config_get( 'add_profile_threshold' ), $t_user_id );
}

profile_create( $t_user_id, $f_platform, $f_os, $f_os_build, $f_description );

If user_id == ALL_USERS, no authorization check for global profile creation is enforced.