CVE-2026-30849: MantisBT Authentication Bypass Vulnerability via SOAP API on MySQL
Summary
CVE-2026-30849: MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL. Affects mantisbt/mantisbt versions < 2.28.1. Fixed in 2.28.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mantis Bug Tracker (MantisBT) is an open-source issue tracker designed for software development projects. It provides a user-friendly interface for managing bugs and feature requests, allowing teams to collaborate effectively. The application supports various database backends, but this specific vulnerability affects only those running on MySQL and compatible databases, where improper type checking can lead to security issues.
Vulnerability Detail
MantisBT is vulnerable to an authentication bypass through its SOAP API when used with MySQL databases. This vulnerability arises from improper type checking on the password parameter, allowing an attacker who knows a victim's username to log in without knowing the actual password. By crafting a specific SOAP envelope, the attacker can execute any API function accessible to the victim, potentially leading to unauthorized access and data exposure.
How To Fix
Minimum fixed version
2.28.1
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.28.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the SOAP API to significantly reduce the risk of exploitation. This can be done by modifying the configuration settings in your MantisBT installation. Refer to the Admin Guide for detailed instructions on disabling the SOAP API: https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.config.api.disable.
Conclusion
The authentication bypass vulnerability in MantisBT's SOAP API poses a significant risk to users running MySQL databases. It is crucial to update to the patched version 2.28.1 to mitigate this risk. Additionally, disabling the SOAP API can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical level of risk.
All versions of MantisBT prior to 2.28.1 that use MySQL or compatible databases are affected by this vulnerability.
Yes, an attacker can exploit this vulnerability remotely if they know the victim's username.
An attacker can gain unauthorized access to user accounts, execute API functions, and potentially retrieve sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
