CVE-2003-1044: editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove gro...

Security readout for executives and security teams

This is an old Bugzilla authorization flaw. In Bugzilla 2.16.3 and earlier, a deleted group could leave behind group-add privileges that later applied to a new group reusing the same ID. That could let already-privileged users add members to a group they should not control. Exposure is most likely limited to legacy Bugzilla 2.16.3 or earlier deployments with usebuggroups enabled, especially systems where groups were deleted and later recreated. Modern or upgraded Bugzilla deployments are not shown as affected in the provided bundle. Treat this as a legacy-platform cleanup issue unless an affected Bugzilla instance is still operating. If present on a business-critical or internet-facing tracker, prioritize remediation because group membership changes can affect confidentiality and workflow control. Mitigation focus: Inventory Bugzilla instances and confirm exact versions.; Check Bugzilla, Mozilla, and distribution advisories for fixed-version guidance.; Prioritize replacing Bugzilla 2.16.3 and earlier if still deployed..

Prepared

Jun 30, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.