Mantis Bug Tracker allows a project‑level user to add themselves as a monitor to a private issue through a crafted POST request to bug_monitor_add.php. Although the application displays an Access Denied error, the request succeeds, creating an unauthorized monitoring relationship. The user cannot view the private issue directly but receives email notifications that reveal the issue’s metadata and content, resulting in unintended information disclosure.

The vulnerability affects the MantisBugTracker product, specifically versions 2.28.1 and earlier.

The CVSS score of 5.3 indicates moderate severity. Exploitation requires a user with legitimate project‑level access and the ability to send a crafted POST request to the web interface of the vulnerable MantisBT instance. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. The primary risk is the disclosure of private issue details via email notifications, which could lead to sensitive information leakage.