PT-2026-27178 · Unknown+1 · Mantis Bug Tracker+1

Jbince · Published 2026-03-23 · Updated 2026-03-27 · CVE-2026-30849

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker versions prior to 2.28.1

Description Mantis Bug Tracker is an open source issue tracker. Instances running on MySQL family databases are affected by an authentication bypass in the SOAP API due to improper type checking on the password parameter. An attacker knowing a victim's username can log in to the SOAP API without the actual password and execute any API function they have access to by using a crafted SOAP envelope. The issue stems from MySQL's implicit string-to-integer conversion during password checks. Disabling the SOAP API reduces the risk, but an attacker can still retrieve user account information, including email address and real name.

Recommendations Versions prior to 2.28.1 should be updated to version 2.28.1 or later. As a workaround, disable the SOAP API.

Exploit

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2026-30849

GHSA-PHRQ-PC6R-F6GH

Affected Products

Mantis Bug Tracker

Mysql Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30849.json · Exploit
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh · Vendor Advisory
• https://github.com/mantisbt/mantisbt/commit/b349e5c890eeda9bd82e7c7e14479853f8a30d9f · Patch
• https://osv.dev/vulnerability/GHSA-phrq-pc6r-f6gh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30849 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30849 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://twitter.com/pulsepatchio/status/2036820686904127897 · Twitter Post
• https://twitter.com/jowardsec/status/2036794465487126616 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2037512963511246857 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036162120870486173 · Twitter Post
• https://twitter.com/VivekIntel/status/2036846157549494611 · Twitter Post