Manticore Search CVE-2026-92796

Requires a valid but low-privileged (read-only) authenticated account on a Manticore Search instance running an affected version (27.0.0 through 28.4.3) that accepts multi-statement SQL requests over the MySQL protocol interface; the attacker crafts a request appending extra SELECT statements after the first, whose permissions are never re-validated. Limiting factors: an existing account with SQL access is needed (PR:L, not unauthenticated), and the instance must permit multi-statement queries; upgrading to 28.4.4 fully remediates. No user interaction and no non-default feature toggle beyond standard SQL access are required.

This is a genuine, actionable priority rather than a high-CVSS-but-low-real-risk paper finding. The vendor CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H), and the key aggravating signals reinforce each other: publicly available exploit code exists (geo-chen/oss write-up), a patch is available, and the flaw was reported by a credible research org (VulnCheck). The CVSS vector cleanly matches the description - network-reachable, low attack complexity, no user interaction, and PR:L (a low-privileged/read-only account is required, so this is authenticated). The one honest caveat is that the DIRECT technical impact of the bug is unauthorized READ of credential tables (confidentiality); the VI:H/VA:H integrity/availability ratings are downstream consequences of stealing admin password hashes and re-authenticating as administrator (pass-the-hash), not a separate memory-corruption or write primitive - a defensible but slightly generous rating. No EPSS score and no CISA KEV entry were provided in the input, so there is no evidence of active in-the-wild exploitation; the risk here is driven by public POC availability plus low exploitation prerequisites, not confirmed exploitation. Overall: prioritize patching to 28.4.4 because a working exploit is public and the privilege bar is merely 'any authenticated read-only user.'

An attacker holding any low-privileged, read-only Manticore Search account sends a multi-statement SQL request where a permitted first statement is followed by an appended SELECT against internal credential tables; because permissions are only validated for the first statement, the extra SELECT executes and returns administrator password hashes. The attacker then authenticates as an administrator using the stolen hash (no plaintext recovery needed), achieving full control. Public exploit code for this technique already exists.