CVE-2026-47156
MantisBT versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. An attacker who knows any valid cookie string can impersonate any user, including the administrator, without needing the target's password. The issue is fixed in MantisBT 2.28.4.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
MantisBT installations running version 2.28.3 or earlier (self‑registration enabled by default).
Real-world impact
An attacker can register a normal account, obtain their own cookie string, and then use the SOAP API to authenticate as any other user, gaining full administrative privileges.
Why this severity
CVSS v4.0 base score 9.3 (Critical) reflects network‑adjacent attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
What to do about it
- 011. Upgrade MantisBT to version 2.28.4 or later.
NVD-referenced vendor advisory
Timeline
- Sep 9, 2026 · 4d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 9, 2026 · 4d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.