CVE-2006-6574: Mantis

Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days.

Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the Change column, as demonstrated by the Change column of a custom field.

Affected products

• Mantis Mantis: up to and including 1.1.0a1; version 1.0.0 only; version 1.0.0_rc1 only; version 1.0.0_rc2 only; version 1.0.0_rc3 only; version 1.0.0_rc4 only; …

Published 2006-12-15. Last modified 2026-06-16.