CVE-2012-1121: MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with man...

Security readout for executives and security teams

CVE-2012-1121 affects MantisBT before 1.2.9. A logged-in user with manager privileges could change or delete global issue categories without proper permission checks. This is mainly an integrity and operations risk: issue tracking structure can be altered, disrupting workflows and reporting. Exposure is limited to organizations still running MantisBT before 1.2.9, especially where manager-level accounts exist outside the trusted administrator group. Internet exposure increases account-compromise consequences but this is not described as unauthenticated access. Treat this as a moderate-priority legacy application issue. It is not reported as actively exploited, but it can damage issue-tracking integrity where old MantisBT installations remain in use. Mitigation focus: Upgrade affected MantisBT deployments to 1.2.9 or later.; Review MantisBT vendor, Fedora, or Gentoo package guidance for your deployment.; Restrict manager privileges to trusted users only..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.