What is CVE-2025-55155?

CVE-2025-55155 is a medium-severity vulnerability in Mantisbt, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 5.4/10. Published 2025-11-04.

How severe is CVE-2025-55155?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Mantisbt

CVE-2025-55155

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing the user from receiving system notifications. Notifications sent to another person's email address could lead to information disclosure. This issue is fixed in version 2.27.2.

EPSS: 0.001 (4.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Mantisbt — versions < 2.27.2

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Exploit, x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2025-55155?: CVE-2025-55155 is a medium-severity vulnerability in Mantisbt, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 5.4/10. Published 2025-11-04.
How severe is CVE-2025-55155?: Medium severity. CVSS v3 base score is 5.4 out of 10.