Which versions of Mantisbt are affected by CVE-2026-30849?

CVE-2026-30849 presents critical security risk rated CVSS 9.3. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-30849?

Yes, a public proof-of-concept exploit is available for CVE-2026-30849. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-30849?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Mantisbt CVE-2026-30849

Q: What is the CVSS score of CVE-2026-30849?

CVE-2026-30849 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-14516 CRITICAL

Authentication Bypass by Primary Weakness (CWE-305)

2026-03-23 GitHub_M

Authentication Bypass Mantisbt

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 23, 2026 - 19:30 euvd

EUVD-2026-14516

Analysis Generated

Mar 23, 2026 - 19:30 vuln.today

CVE Published

Mar 23, 2026 - 19:10 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

AnalysisAI

MantisBT versions prior to 2.28.1 contain an authentication bypass vulnerability in the SOAP API caused by improper type checking on the password parameter when running on MySQL family databases. An attacker who knows a victim's username can log in to the SOAP API without knowing the correct password and execute any API function available to that account. While a CVE CVSS score is not yet assigned, the vulnerability is patched in version 2.28.1, and disabling the SOAP API reduces but does not eliminate the risk.

Technical ContextAI

The vulnerability stems from CWE-305 (Missing Cryptographic Step) and is fundamentally rooted in improper type checking during SOAP API authentication. The affected product MantisBT (cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*) uses MySQL family databases (MySQL, MariaDB, Percona) which perform implicit type coercion from strings to integers during SQL operations. When a crafted SOAP envelope is submitted with a specially formatted password parameter, MySQL's type juggling causes the authentication logic to incorrectly evaluate the password check, treating a non-matching string as equivalent to a numeric zero or false value. This implicit type conversion does not occur in other database backends such as PostgreSQL, Microsoft SQL Server, or SQLite, which enforce stricter type checking. The SOAP API endpoint is the primary attack surface, though user enumeration is still possible even when the SOAP API is disabled.

RemediationAI

Immediately upgrade MantisBT to version 2.28.1 or later to patch the authentication bypass vulnerability. See the vendor security advisory at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh for detailed upgrade instructions. Until patching is complete, disable the SOAP API endpoint if it is not required for your operations—this removes the primary attack vector, although user enumeration via other endpoints remains possible. Additionally, restrict network access to MantisBT to trusted IP ranges and implement network-level rate limiting on login attempts. Monitor authentication logs for suspicious SOAP API access patterns or multiple failed login attempts from external sources. If running MantisBT on MySQL or MariaDB, ensure database user permissions follow the principle of least privilege.