CVE-2012-1118

CVE-2012-1118 describes an access restriction bypass vulnerability in MantisBT versions prior to 1.2.9. Specifically, the access_has_bug_level function in core/access_api.php fails to properly restrict access when the private_bug_view_threshold is configured as an array. This flaw allows unauthenticated remote attackers to bypass intended security controls and perform unauthorized operations on private bug reports. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity, requiring no authentication, and potentially leading to partial confidentiality impact. The FAUCET Risk Score is 13/100, suggesting a relatively low overall risk. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.