CVE-2026-47156

MantisBT versions 2.28.3 and earlier contain a critical authentication flaw (CWE-287/CWE-639) in the SOAP API's mci_check_login() function, where the client-supplied username is trusted if the caller presents any valid cookie_string. An attacker who knows a target username and any valid cookie_string can authenticate as that user via the SOAP API without knowing the target's password; on default installations ($g_allow_signup = ON) an unauthenticated attacker can self-register, log in, read their own MANTIS_STRING_COOKIE, and use it to impersonate the administrator. This yields full administrator-level access to the bug tracker through the SOAP API, with high confidentiality, integrity and availability impact (CVSS 4.0 score 9.3). Only MantisBT deployments up to 2.28.3 using the SOAP API are affected; the REST API and the Web UI are not affected because they derive the username server-side from API tokens, session cookies, or validated cookie values. There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not in CISA KEV; version 2.28.4 contains the patch and no workarounds are known.

What to do: Upgrade all MantisBT instances to version 2.28.4 immediately, as no workarounds are available. Until patched, restrict network access to the SOAP API (e.g., allow-list trusted clients) and review authentication logs for unexpected logins as the administrator or other users via SOAP. The REST API and Web UI are unaffected, so no compensating action is needed there beyond applying the patch.