Authentication Bypass in MantisBT Bug Tracker - MantisBT

CVE-2026-47156

What is CVE-2026-47156?

MantisBT is an open-source bug tracking software that, in versions 2.28.3 and earlier, is susceptible to an authentication bypass vulnerability in its SOAP API's mci_check_login() function. Affected installations allow any user with knowledge of a valid cookie_string to impersonate any other user, including administrators, without needing the user's password. This is particularly concerning as MantisBT’s self-registration feature is enabled by default, which permits unauthorized access. Users can exploit this vulnerability by using their own cookie_string, which is visible in their browser's MANTIS_STRING_COOKIE, to gain access to administrative functionalities. Updating to version 2.28.4, which includes necessary patches, is essential for protecting against this threat. Please note that the vulnerability does not extend to the REST API or the Web UI, which have safer authentication mechanisms.

References