| Description | The REST issue-update endpoint PATCH /api/rest/issues/{id} allows an UPDATER-level user to set an unreleased product version that is absent from the normal web update form.
From the MantisBT UI, unreleased versions are only available if the user has $g_report_issues_for_unreleased_versions_threshold (DEVELOPER by default).
The same issue is also present from the SOAP API (see duplicate issue #37068 for details), since both APIs rely on mc_issue_update().. |
|---|
| Steps To Reproduce | Control request:
GET /bug_update_page.php?bug_id=4 as developer at UPDATER (40)
Observed form fragment:
<select tabindex="10" id="version" name="version" class="input-sm"><option value=""> </option></select>
REST request:
PATCH /api/rest/issues/4 HTTP/1.1
Content-Type: application/json
{
"version": { "name": "UNREL-UPD-2026" }
}
Observed response:
HTTP/1.1 200 Issue with id 4 Updated
Observed response body excerpt:
"version":{"id":"5","name":"UNREL-UPD-2026"}
|
|---|
| Additional Information | Severity:
Medium (authorization bypass)
Type:
Server-side authorization flaw
Affected code:
api/rest/restcore/issues_rest.php (lines 407-441)
api/soap/mc_issue_api.php (shared mc_issue_update() path)
Why it happens:
rest_issue_update() delegates directly to mc_issue_update():
$t_result = mc_issue_update( /* username */ '', /* password */ '', $t_issue_id, $t_issue );
And mc_issue_update() resolves the supplied version by existence only:
$fn_get_version_id = function( string $p_field, array $p_issue, int $p_project_id ): int {
if( !isset( $p_issue[$p_field] ) ) {
return 0;
}
return mci_get_version_id( $p_issue[$p_field], $p_project_id, $p_field );
};
Impact:
Users below report_issues_for_unreleased_versions_threshold can assign hidden
unreleased product versions through REST updates. |
|---|
