CVE-2026-47156

Deferred Deferred - Pending Action

Authentication Bypass in MantisBT SOAP API

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API. The REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed. The Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client. Version 2.28.4 contains a patch. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-47156

EUVD

EUVD-2026-75087

Affected Vendors & Products

Vendor	Product	Version / Range
mantisbt	mantisbt	to 2.28.4 (exc)
mantisbt	mantisbt	2.28.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-47156 is a critical authentication bypass vulnerability in MantisBT versions 2.28.3 and earlier. It affects the SOAP API's mci_check_login() function, allowing any user with a valid cookie string to authenticate as any other user, including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access because MantisBT enables self-registration by default.

Detection Guidance

Check MantisBT version with command: grep -r "mantisbt_version" /path/to/mantisbt/config. If version is 2.28.3 or earlier, the system is vulnerable. Inspect SOAP API logs for unusual authentication attempts or failed login patterns.

Impact Analysis

An attacker can exploit this vulnerability to gain full administrator access to the SOAP API. This allows them to read or write all issues, exfiltrate sensitive data, and perform destructive operations like deleting projects or issues. The REST API and Web UI are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA. It may result in data breaches, unauthorized data access, or data manipulation, all of which are critical compliance violations.

Mitigation Strategies

Upgrade MantisBT to version 2.28.4 or later immediately. Disable self-registration in config by setting $g_allow_signup = OFF. Monitor SOAP API access logs for suspicious activity. Consider disabling SOAP API if not required.

Hi! I’m here to help you understand CVE-2026-47156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70