CVE-2026-30849

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

• CWE-305

• https://github.com/mantisbt/mantisbt/commit/b349e5c890eeda9bd82e7c7e14479853f8a30d9fPatch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6ghMitigation, Patch, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30843Wekan is an open source kanban tool built with Meteor. Versi…6.5
• CVE-2026-30844Wekan is an open source kanban tool built with Meteor. Versi…8.1
• CVE-2026-30845Wekan is an open source kanban tool built with Meteor. In ve…8.2
• CVE-2026-30846Wekan is an open source kanban tool built with Meteor. In ve…7.5
• CVE-2026-30847Wekan is an open source kanban tool built with Meteor. In ve…6.5
• CVE-2026-30848Parse Server is an open source backend that can be deployed …3.7
• CVE-2026-3085GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Cod…8.8
• CVE-2026-30850Parse Server is an open source backend that can be deployed …5.9
• CVE-2026-30851Caddy is an extensible server platform that uses TLS by defa…8.8
• CVE-2026-30852Caddy is an extensible server platform that uses TLS by defa…7.5
• CVE-2026-30853calibre is a cross-platform e-book manager for viewing, conv…8.2
• CVE-2026-30854Parse Server is an open source backend that can be deployed …5.3