Which versions of MantisBT are affected by CVE-2026-47156?

MantisBT 2.28.3 and earlier contains a critical privilege escalation vulnerability in its SOAP API that allows attackers to impersonate any user, including administrators, and gain full read/write…. A patch is available.

How to fix or mitigate CVE-2026-47156?

Within 24 hours: Identify all MantisBT deployments running version 2.28.3 or earlier and document which instances have self-registration enabled ($g_allow_signup = ON) to prioritize exposure assessment. Within 7 days: Obtain and deploy the vendor-released patch to all affected MantisBT installations, prioritizing systems with self-registration enabled, and validate the update in a staging environment first. Within 30 days: Review SOAP API logs for the past 90 days to identify suspicious login attempts or impersonation activity, conduct an access audit to verify only legitimate administrators accessed systems, and evaluate disabling self-registration on all MantisBT instances unless specifically required for business operations.

MantisBT CVE-2026-47156

Q: What is the CVSS score of CVE-2026-47156?

CVE-2026-47156 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-75087 CRITICAL

Improper Authentication (CWE-287)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-c2xg-qjqw-2v98

PHP Authentication Bypass

9.3

CVSS 4.0 · Vendor: https://github.com/mantisbt/mantisbt

Severity by source

Vendor (https://github.com/mantisbt/mantisbt) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Default self-registration gives a zero-prior-access attacker a valid cookie_string (PR:N) over the network with low complexity, yielding full admin impersonation with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/mantisbt/mantisbt).

CVSS VectorVendor: https://github.com/mantisbt/mantisbt

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 17:02 vuln.today

Analysis Generated

Jul 15, 2026 - 17:02 vuln.today

CVE Published

Jul 15, 2026 - 16:45 cve.org

CRITICAL

DescriptionCVE.org

MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password.

The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API.

The REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed.

The Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client.

Impact

Full administrator access to the SOAP API from zero prior access (with self-registration enabled, which is the default)
Read/write all issues including private issues and notes across all projects
Full data exfiltration of all bug reports, attachments, user accounts (id, name, email), and non-private configuration values via the 71 SOAP operations available
Destructive operations: delete projects, issues, attachments, tags, categories, and versions
Data manipulation: create/modify issues, impersonate reporters, manage project structure
Chains with other vulnerabilities: the SOAP admin access enables exploitation of SOAP vulnerabilities that require administrator privileges

Patches

https://github.com/mantisbt/mantisbt/commit/e3571c319b1721b41b0dc4b5b5203cbdcbe0c2ee

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37121

Credits

MantisBT would like to thank McCaulay Hudson (@_McCaulay) of watchTowr for originally identifying and responsibly reporting the issue.

The vulnerability was subsequently discovered by other researchers, while the team was working on fixing and preparing the release. MantisBT credits them here, in chronological order of their reports:

Keitaro Yamazaki (@tyage)
Harrison Keating (@voraci0us)
Chandler Johnson (@chndlrx)
Bharat Devasani (@bharatdevasani)

Articles & Coverage 1

News Critical Privilege Escalation in MantisBT via SOAP API - CVE-2026-47156 Jul 16, 2026

AnalysisAI

Privilege escalation to administrator in MantisBT 2.28.3 and earlier lets a low-privileged or self-registered user impersonate any account, including the administrator, through the SOAP API's flawed mci_check_login() function. Because the function accepts any valid cookie_string without checking that it belongs to the supplied username, an attacker who knows a target username (e.g. 'administrator') and possesses their own MANTIS_STRING_COOKIE can authenticate as that user without a password. With self-registration enabled by default ($g_allow_signup = ON), this is exploitable from zero prior access, granting full read/write and destructive control over all projects, issues, and user data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the underlying bug is trivially reliable.

Technical ContextAI

MantisBT is a widely used open-source PHP web-based bug tracker, distributed via Composer as mantisbt/mantisbt (CPE pkg:composer/mantisbt_mantisbt). The flaw resides in api/soap/mc_api.php, in the SOAP (Mantis Connect) authentication path. MantisBT maintains a per-user secret 'cookie_string' stored in the MANTIS_STRING_COOKIE browser cookie. The vulnerable mci_check_login() validated that the presented cookie_string corresponded to some valid user, but never verified that the resolved user identity matched the $p_username the client claimed to be - the classic CWE-287 (Improper Authentication) root cause. The patch (commit e3571c31) adds a strcasecmp() check comparing user_get_username() of the cookie's owner against the requested username, rejecting the login when they differ. Notably, only the legacy SOAP API is affected; the REST API's AuthMiddleware and the Web UI both derive the username server-side from the token/session cookie rather than trusting a client-supplied username, so they are immune to the same trick.

RemediationAI

Vendor-released patch: upgrade to MantisBT 2.28.4, which contains fix commit e3571c319b1721b41b0dc4b5b5203cbdcbe0c2ee adding a username-to-cookie ownership check in mci_check_login(). The advisory states there are no official workarounds, but if immediate upgrade is impossible, compensating controls include disabling the SOAP API entirely if it is not in use (the REST API and Web UI are unaffected and can continue to serve integrations), and disabling self-registration by setting $g_allow_signup = OFF to remove the zero-prior-access path - note this stops new users from registering and forces admin-created accounts, but does not fully close the hole for anyone who already holds a valid low-privileged account. Additionally restrict network access to the SOAP endpoint (api/soap/) to trusted hosts via reverse-proxy or firewall rules as a stopgap. Advisory and patch: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-c2xg-qjqw-2v98 and https://github.com/mantisbt/mantisbt/commit/e3571c319b1721b41b0dc4b5b5203cbdcbe0c2ee.