CVE-2012-2692: Mantisbt

Low severity, CVSS 3.6. EPSS: 1.5% chance of exploitation in the next 30 days.

MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.

Affected products

• Mantisbt Mantisbt: up to and including 1.2.10; version 0.18.0 only; version 0.19.0 only; version 0.19.1 only; version 0.19.2 only; version 0.19.3 only; …

Published 2012-06-17. Last modified 2026-06-16.