MantisBT SOAP API auth bypass & privilege escalation analysis

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: SOAP API Authentication Bypass → Privilege Escalation to Administrator Vulnerability ID: WT-2026-0064 Affected Product: MantisBT (Mantis Bug Tracker) Affected Version: 2.28.1 Platform: Linux CVE: CVE-2026-47156 Root Cause: 1. Incorrect cookie string validation logic ( , lines 482-489): is only used for a boolean check and is not compared against the current user, allowing any cookie string to pass validation. 2. Password validation is skipped ( , lines 711-716): defaults to , causing the password check to be bypassed. 3. Self-registration provides a path to exploit zero-access privileges: Under default configuration, an attacker can escalate from zero privileges to administrator. Scope of Impact Full administrator access to the SOAP API (achievable from prior privileges when self-registration is enabled by default) Read access to all projects (including internal file paths) Data tampering: Creating/modifying issues, reporters, and project structures Chained exploitation with other vulnerabilities: SOAP administrator privileges can trigger other SOAP vulnerabilities that require administrator access Fix Details Fixed in Version: 2.28.4 Fix Commit: Fix Details: - Prevents SOAP API authentication bypass (cookie_string validation) - Verifies that the cookie string actually belongs to the user attempting to log in; otherwise, login is rejected - Username comparison changed to be case-insensitive - Modified files: , POC Code 1. Authenticating as Administrator Using a Low-Privilege User's Cookie Response (confirms authentication as administrator, ): 2. Listing All Projects Using a Low-Privilege User's Cookie Response (returns all projects, including internal file paths, accessible only to administrators):

Goal Reached Thanks to every supporter — we hit 100%!

MantisBT SOAP API auth bypass & privilege escalation analysis