CVE-2026-47156: MantisBT Critical SOAP API Authentication Bypass and Privilege Escalation
Summary
CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator. Affects mantisbt/mantisbt versions < 2.28.4. Fixed in 2.28.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MantisBT is an open-source issue tracker designed for software development projects. It provides a web-based interface for managing bugs and issues, allowing users to report, track, and resolve problems efficiently. The software includes various APIs for integration, including a SOAP API that facilitates communication between MantisBT and other applications. However, a critical vulnerability has been identified in versions 2.28.3 and earlier, which allows unauthorized access to the SOAP API, potentially compromising the entire system.
Vulnerability Detail
The vulnerability arises from an authentication bypass in the SOAP API's mci_check_login() function. Any user with a valid cookie_string can authenticate as any other user, including administrators, without needing their password. This flaw is particularly dangerous as it can be exploited by self-registered users due to the default self-registration setting being enabled. The implications include unauthorized access to sensitive data, the ability to manipulate issues, and the potential for destructive actions such as deleting projects and data exfiltration.
How To Fix
Minimum fixed version
2.28.4
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.28.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate this vulnerability. The best course of action is to update to the latest version of MantisBT as soon as possible.
Conclusion
In summary, the CVE-2026-47156 vulnerability in MantisBT poses a significant risk due to an authentication bypass in the SOAP API. It allows unauthorized users to gain administrator access, leading to potential data breaches and system manipulation. Immediate action is required to update to the patched version to safeguard your application.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
Yes, the vulnerability can be exploited without any prior access, as self-registration is enabled by default.
No, the REST API is not affected because it uses server-side authentication methods that prevent username spoofing.
An attacker can access all issues, including private ones, user accounts, and configuration values, and can perform destructive operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
