CVE-2024-23830

MantisBT is an open source issue tracker. Prior to version 2.26.1, an unauthenticated attacker who knows a user's email address and username can hijack the user's account by poisoning the link in the password reset notification message. A patch is available in version 2.26.1. As a workaround, define `$g_path` as appropriate in `config_inc.php`.

• CWE-74

• https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744Patch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mcqj-7p29-9528Patch, Vendor Advisory
• https://mantisbt.org/bugs/view.php?id=19381Exploit, Vendor Advisory
• https://github.com/mantisbt/mantisbt/commit/7055731d09ff12b2781410a372f790172e279744Patch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-mcqj-7p29-9528Patch, Vendor Advisory
• https://mantisbt.org/bugs/view.php?id=19381Exploit, Vendor Advisory

Published

Feb 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23825TablePress is a table plugin for Wordpress. For importing ta…4.9
• CVE-2024-23826spbu_se_site is the website of the Department of System Prog…5.7
• CVE-2024-23827Nginx-UI is a web interface to manage Nginx configurations. …9.8
• CVE-2024-23828Nginx-UI is a web interface to manage Nginx configurations. …8.8
• CVE-2024-23829aiohttp is an asynchronous HTTP client/server framework for …6.5
• CVE-2024-2383A clickjacking vulnerability exists in zenml-io/zenml versio…6.1
• CVE-2024-23831LedgerSMB is a free web-based double-entry accounting system…7.5
• CVE-2024-23832Mastodon is a free, open-source social network server based …9.8
• CVE-2024-23833OpenRefine is a free, open source power tool for working wit…7.5
• CVE-2024-23834Discourse is an open-source discussion platform. Improperly …6.1
• CVE-2024-23835Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23836Suricata is a network Intrusion Detection System, Intrusion …7.5