CVE-2026-47156

MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password. The vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API. The REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed. The Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client. Version 2.28.4 contains a patch. No known workarounds are available.

• CWE-287
• CWE-639

• https://github.com/mantisbt/mantisbt/commit/e3571c319b1721b41b0dc4b5b5203cbdcbe0c2ee
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-c2xg-qjqw-2v98
• https://mantisbt.org/bugs/view.php?id=37121

Published

Sep 9, 2026

Last Modified

Sep 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47150In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollme…7.1
• CVE-2026-47151In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySched…7.1
• CVE-2026-47152In EmberZNet v9.0.2 and earlier, a malformed Level Control M…6.5
• CVE-2026-47153In EmberZNet v9.0.2 and earlier, a malformed Level Control S…6.5
• CVE-2026-47154In EmberZNet v9.0.2 and earlier, a malformed GetProfileRespo…6.5
• CVE-2026-47155vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-47157aiograpi is an asynchronous Instagram API for Python. aiogra…6.5
• CVE-2026-47158Vaultwarden is a Bitwarden-compatible server written in Rust…8.3
• CVE-2026-47159Vaultwarden is a Bitwarden-compatible server written in Rust…6.9
• CVE-2026-4716Incorrect boundary conditions, uninitialized memory in the J…9.1
• CVE-2026-47160Vaultwarden is a Bitwarden-compatible server written in Rust…5.8
• CVE-2026-47161RELATE is a web-based courseware package. Prior to commit d6…8.7