Mantisbt EUVD-2026-14516

MantisBT versions prior to 2.28.1 running on MySQL family databases with SOAP API enabled. Attacker requires knowledge of victim's username only. Remote unauthenticated attacker can bypass authentication by sending crafted SOAP envelope with type-confused password parameter. No victim interaction required.

While a CVSS vector and EPSS score are not currently available, the real-world risk is substantial based on several factors. The vulnerability is unauthenticated and network-accessible (attack vector: network), requires no special privileges to initiate, and has relatively low complexity—an attacker only needs to know a username, which is often easily enumerable or publicly disclosed. The patch is available (version 2.28.1), indicating the vendor has confirmed and resolved the issue. The GitHub security advisory (GHSA-phrq-pc6r-f6gh) and commit evidence (b349e5c) confirm active development and vendor acknowledgment. This is a legitimate high-priority vulnerability because it provides complete authentication bypass to the SOAP API—enabling account takeover, unauthorized API access, and potential lateral movement within MantisBT installations. Organizations running MantisBT on MySQL family databases with SOAP API enabled should prioritize immediate patching; those unable to patch should disable the SOAP API as a workaround, though this introduces user enumeration risk.

An attacker discovers a MantisBT instance running version 2.27.0 on MySQL and enumerates a valid username (e.g., 'admin') through the web interface or public documentation. The attacker crafts a SOAP envelope containing the username and a maliciously formatted password parameter (e.g., a numeric value or boolean that causes MySQL type coercion to succeed). Upon sending this SOAP request, MySQL's implicit type conversion evaluates the password check as true, granting the attacker authenticated access to the SOAP API as the admin user. The attacker then uses SOAP API functions to create new administrator accounts, modify issues, or export sensitive project data.