CVE-2012-2692: MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_valida...

Security readout for executives and security teams

MantisBT before 1.2.11 could let a logged-in user delete attachments they should not be allowed to delete when form security validation was disabled. The business impact is unauthorized loss of issue-tracker evidence, files, or workflow records, not full system compromise based on the provided sources. Exposure is limited to MantisBT deployments before 1.2.11 with form_security_validation disabled and authenticated users who can reach attachment deletion workflows. Public or partner-facing trackers have higher practical risk than tightly controlled internal instances. Handle during normal vulnerability remediation unless the tracker is internet-facing, partner-facing, or contains critical operational evidence. Prioritize faster if old MantisBT remains in production with broad authenticated access. Mitigation focus: Upgrade MantisBT to 1.2.11 or later where supported.; Keep form_security_validation enabled unless vendor guidance says otherwise.; Review MantisBT vendor advisories and distribution package updates..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.