Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-30849— MantisBT SOAP API has an authentication bypass vulnerability on MySQL

Quick assessment

Affected
mantisbt mantisbt
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mantis Bug Tracker（MantisBT）是Mantis Bug Tracker开源的一个 bug 跟踪器。 Mantis Bug Tracker 2.28.1之前版本存在安全漏洞，该漏洞源于SOAP API对密码参数类型检查不当，可能导致身份验证绕过。

AI Predicted 9.8 Difficulty: Easy EPSS 2.35% · P83

Public Exploits 1

Nuclei · 1 CVE-2026-30849.yaml [template]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-30849

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
Source: CVE Program / CVE List V5
Vulnerability Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用基本弱点进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
Mantis Bug Tracker 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mantis Bug Tracker（MantisBT）是Mantis Bug Tracker开源的一个 bug 跟踪器。 Mantis Bug Tracker 2.28.1之前版本存在安全漏洞，该漏洞源于SOAP API对密码参数类型检查不当，可能导致身份验证绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
mantisbt mantisbt < 2.28.1 -

II. Public POCs for CVE-2026-30849

# POC Description Source Link Shenlong Link
1 Mantis Bug Tracker < 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30849.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-30849

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-30849 (1)

Vendor Advisories for CVE-2026-30849 (1)

Same Patch Batch · mantisbt · 2026-03-23 · 3 CVEs total

CVE-2026-33517 MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
CVE-2026-33548 MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline

IV. Related Vulnerabilities

Same product: mantisbt
Same vendor: mantisbt
Same weakness: CWE-305

V. Comments for CVE-2026-30849

No comments yet

Leave a comment