The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attacke…

published 2012-06-17 14 y ago modified 2026-06-16 4 mo ago also EUVD-2012-2673

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.8%; EPSS 3.8% chance of exploitation in 30 days, percentile 90%
public exploits: 0; none known

The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.

Patch / fix

links 2

github.com/mantisbt/mantisbt@175d973 commit
github.com/mantisbt/mantisbt@edc8142 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-2691 updated 2025-11-21 cvss 3.5

mantis: Reporters able to edit arbitrary bugnotes via SOAP API

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.79% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

github.com /mantisbt/mantisbt/commit/175d973105fe9f03a37ced537b742611631067e0
exploit, patch
github.com /mantisbt/mantisbt/commit/edc8142bb8ac0ac0df1a3824d78c15f4015d959e
exploit, patch
lists.fedoraproject.org /pipermail/package-announce/2012-November/093063.html
vendor-advisory
security.gentoo.org /glsa/glsa-201211-01.xml
vendor-advisory
lists.fedoraproject.org /pipermail/package-announce/2012-November/093064.html
vendor-advisory
lists.fedoraproject.org /pipermail/package-announce/2012-November/092926.html
vendor-advisory
secunia.com /advisories/49414
third-party-advisory, vendor-advisory
mantisbt.org /bugs/view.php?id=14340
securityfocus.com /bid/56467
vdb-entry
openwall.com /lists/oss-security/2012/06/11/6
mailing-list
mantisbt.org /bugs/changelog_page.php?version_id=148
secunia.com /advisories/51199
third-party-advisory
securityfocus.com /bid/53907
vdb-entry
openwall.com /lists/oss-security/2012/06/09/1
mailing-list
exchange.xforce.ibmcloud.com /vulnerabilities/76180
vdb-entry

Sources

CVE List CVE-2012-2691
NVD CVE-2012-2691

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary