MantisBT bug can let attackers hijack admin accounts

Published July 15, 2026 CVE-2026-47156

MantisBT's SOAP API has a critical flaw that lets attackers bypass login and take over admin accounts. Attackers can then change passwords, delete data, or lock users out.

Severity
CriticalCVSS 4.0 · 9.3 · github.com
Fix
Fixed in 2.28.4
Affected versions
2.28.3 or older
Weakness
CWE-287
Exploit likelihood
0.50% in 30 daysEPSS, higher than 41% of known flaws
Affects
MantisBT

How it works

An attacker sends a specially crafted SOAP request to the SOAP API's login check function, tricking it into thinking they're an admin without a real password.

What to do

Check the installed mantisbt/mantisbt version. This advisory applies to 2.28.3 or older.

Update mantisbt/mantisbt to 2.28.4 or newer. Then verify the installed version.

Technical details

The vulnerability sits in the SOAP API's mci_check_login function. It authenticates a requested username using only the cookie_string value from the caller's own MANTIS_STRING_COOKIE, without verifying that the cookie_string actually belongs to the username being requested. Because self-registration is on by default, any new account can supply the administrator's username alongside its own valid cookie_string and be authenticated as the administrator.

The REST API and the web UI are not affected, since both derive the username server-side from the session or token rather than trusting a client-supplied value. Once authenticated as administrator over SOAP, an attacker can read and write all issues, including private ones, export user account data and attachments, and delete projects, issues, and other records across the 71 available SOAP operations. Fixed in MantisBT 2.28.4.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Open in FIRST.org calculator

References

View Original Source