CVE-2026-47156 in MantisBT
Summary
by MITRE • 09/09/2026
MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API. The REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed. The Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client. Version 2.28.4 contains a patch. No known workarounds are available.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
MantisBT versions prior to 2.28.3 contain a critical authentication bypass vulnerability within its SOAP API implementation that allows an attacker to impersonate any user, including administrators, without possessing their password. This flaw resides specifically in the mci_check_login function, which is responsible for validating credentials when accessing the SOAP interface. The root cause of this issue lies in how the application handles session cookies during authentication requests. Specifically, if an attacker knows a valid cookie_string and the username of the target account they wish to impersonate, they can successfully authenticate as that user. This mechanism effectively bypasses standard password verification processes because the system relies on the presence of a valid session identifier rather than verifying the actual credentials associated with that identity during SOAP API calls.
The severity of this vulnerability is significantly amplified by default configuration settings found in many MantisBT installations. By default, self-registration is enabled through the $g_allow_signup setting being set to ON. This allows unauthenticated users to create accounts on the system without any prior access or invitation. Once a user has registered and logged in via the web interface, they can retrieve their own session cookie_string from the MANTIS_STRING_COOKIE value stored in their browser. An attacker who registers an account can then use this valid cookie_string combined with the username of another target, such as the system administrator, to gain unauthorized access through the SOAP API. This creates a scenario where zero prior access is required for exploitation, making it particularly dangerous for public-facing installations that have not been hardened against self-registration or restricted from external network access.
It is important to distinguish this vulnerability's scope within the MantisBT architecture. The REST API remains unaffected by this specific flaw because its authentication middleware derives the username server-side based on the provided API token or session cookie, preventing client-side spoofing of user identities. Similarly, the Web User Interface is not vulnerable as it authenticates users via PHP session cookies and validates the MANTIS_STRING_COOKIE against the currently logged-in user through the auth_is_cookie_valid function. In these contexts, the username is derived server-side from the authenticated context rather than being supplied directly by the client in a manner that allows for impersonation. This distinction highlights that the vulnerability is isolated to the SOAP API implementation and does not compromise all access vectors of the application simultaneously.
From a technical classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to adequately verify the identity of users attempting to log in via the SOAP interface. Furthermore, it relates to CWE-345 Insufficient Verification of Data Authenticity because the server accepts session cookies without sufficiently binding them to the specific user context provided by the client during authentication attempts. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates Account Manipulation and Credential Access techniques where an adversary leverages valid credentials or tokens to assume another identity within the system. The ability to escalate privileges to administrator level through this method represents a significant risk to data integrity and confidentiality.
Mitigation strategies must focus on immediate patching and configuration hardening since no known workarounds exist for versions prior to 2.28.4. Organizations running MantisBT should upgrade to version 2.28.4 or later as soon as possible, as this release contains the necessary code changes to resolve the authentication bypass logic flaw. For environments where upgrading is not immediately feasible due to operational constraints, administrators should disable self-registration by setting $g_allow_signup to OFF in the configuration file. Additionally restricting access to the SOAP API endpoint via network security controls such as firewalls or reverse proxy rules can limit exposure to untrusted networks. Regular auditing of user accounts and monitoring for unusual authentication patterns through the SOAP interface may also help detect potential exploitation attempts before significant damage occurs.