CVE-2026-92796 Details
Description
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
An authorization bypass vulnerability has been identified in Manticore Search versions 27.0.0 prior to 28.4.4. This vulnerability arises from the application's failure to properly validate permissions for all statements in multi-statement SQL requests. As a result, read-only users can execute unauthorized queries. Exploitation involves appending additional SELECT statements to the first one in a request, enabling access to credential tables that contain password hashes. These hashes can be used to authenticate as administrators without needing to recover the plaintext passwords.
Users can update to Manticore Search version 28.4.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/geo-chen/oss/blob/main/manticoresearch.md | [email protected] | ExploitTechnical Analysis |
| https://github.com/manticoresoftware/manticoresearch | [email protected] | Source CodeVendor |
| https://github.com/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418 | [email protected] | |
| https://github.com/manticoresoftware/manticoresearch/issues/4706 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://www.vulncheck.com/advisories/manticore-search-27.0.0-before-28.4.4-multi-statement-authorization-bypass | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Manticore Search | >= 27.0.0, < 28.4.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |