CVE-2014-9506
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates...
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
Exploit likelihood
What each source reports
NVD Score used
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
- Record
CVE-2014-9506- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
- Record
CVE-2014-9506- Updated
- 2026-11-02
EUVDEUVD-2014-9323 No score
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
- Record
EUVD-2014-9323- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pvg3-5pq8-4hwq No score
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates...
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
- Record
GHSA-pvg3-5pq8-4hwq- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mantisDebian:7 |
before 1.2.18-1, plus listed versions 1.2.11-1.21.2.11-1.2+deb7u1 |
1.2.18-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9506 is a low vulnerability (CVSS 3.5) in Mantisbt, published January 4, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in mantis 1.2.18-1.