CVE-2026-92796

Manticore Search versions 27.0.0 before 28.4.4 contain an incorrect authorization flaw (CWE-863): permission checks are only applied to the first statement of a multi-statement SQL request, so any additional statements are executed without validation. A user holding only read-only privileges can trigger the flaw by appending extra SELECT statements to a single multi-statement request and reading data the account is not authorized to see. By chaining this bypass against credential tables, the attacker obtains administrator password hashes that Manticore accepts directly for authentication, yielding admin-level access without ever recovering a plaintext password. Any Manticore Search deployment in the affected range that exposes its SQL interface to low-privileged users is impacted. No public proof-of-concept is known, the flaw is not in CISA's KEV, and there are no confirmed reports of in-the-wild exploitation.

What to do: Upgrade to Manticore Search 28.4.4 or later. Until patched, restrict the SQL and HTTP interfaces to trusted networks, minimize the number of read-only accounts, and review logs for multi-statement requests containing extra SELECTs against credential tables; rotate administrator credentials if unauthorized queries are found.