CVE-2026-30849 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.
An authentication bypass vulnerability has been identified in Mantis Bug Tracker (MantisBT) versions prior to 2.28.1, specifically in instances using MySQL or compatible databases. The vulnerability arises from improper type checking of the password parameter in the SOAP API, allowing an attacker who knows the victim's username to log in without the actual password. This exploitation enables the attacker to access and execute any API functions available to the victim's account. Other database backends are not affected, as they do not allow implicit type conversion from string to integer.
Users can upgrade to MantisBT version 2.28.1 or later, where this vulnerability has been patched. For those unable to upgrade, disabling the SOAP API can significantly reduce the risk, although it does not completely eliminate it.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/b349e5c890eeda9bd82e7c7e14479853f8a30d9f | [email protected] | Patch |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-305 | Authentication Bypass by Primary Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mantisbt mantisbt | < 2.28.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |