Mantis Bug Tracker Email Change Verification Vulnerability

A vulnerability exists in Mantis Bug Tracker (MantisBT) versions through 2.27.1, where the system allows users to change their email addresses without proper verification. This lack of validation can lead to the storage of incorrect email addresses, causing users to miss important notifications. Furthermore, if notifications are mistakenly sent to an incorrect email, it could result in unauthorized information disclosure.

Impact

Exploitation of this vulnerability could lead to improper email address validation, allowing for the potential interception of email notifications meant for other users.

Reproduction

To reproduce this vulnerability, create a new account and verify the email address. Afterward, change the email address in the account settings. The new email will be updated without any verification, allowing for the possibility of receiving notifications intended for someone else.

Remediation

This vulnerability has been addressed in MantisBT version 2.27.2. Users should update to this version to ensure proper email verification.