MantisBT EUVD-2026-30820

MantisBT is a PHP-based issue tracking system (composer package: mantisbt/mantisbt). The vulnerability exists in the account profile creation mechanism, specifically in account_prof_update.php. The root cause (CWE-639: Authorization Bypass Through User-Controlled Key) stems from insufficient authorization validation on the user_id parameter. The code incorrectly evaluated the condition for enforcing manage_global_profile_threshold: it checked if user_id was NOT equal to ALL_USERS before requiring the elevated permission, when it should have checked if user_id WAS equal to ALL_USERS. This logic inversion allows a low-privileged user with add_profile_threshold to submit a profile creation request with user_id set to ALL_USERS and bypass the global profile authorization check entirely.