CVE Explorer

CVE-2026-30849

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d800a155741383b976f84f207eec4d771c86693b78a74d119a316fc1f9fb2d76

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"mantisbt","vendor":"mantisbt","versions":[{"status":"affected","version":"< 2.28.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:11d28281b879468fd1339072b83a4c08d97ff28c83ae213cfdc54d3e2a9200bc · sha256:30609a4c4c4b5135… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:11d28281b879468fd1339072b83a4c08d97ff28c83ae213cfdc54d3e2a9200bc · sha256:30609a4c4c4b5135… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-305","description":"CWE-305: Authentication Bypass by Primary Weakness","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:11d28281b879468fd1339072b83a4c08d97ff28c83ae213cfdc54d3e2a9200bc · sha256:30609a4c4c4b5135… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/mantisbt/mantisbt/commit/b349e5c890eeda9bd82e7c7e14479853f8a30d9f","tags":["x_refsource_MISC"],"url":"https://github.com/mantisbt/mantisbt/commit/b349e5c890eeda9bd82e7c7e14479853f8a30d9f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:11d28281b879468fd1339072b83a4c08d97ff28c83ae213cfdc54d3e2a9200bc · sha256:30609a4c4c4b5135… · /containers/cna/references/1

{"name":"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh","tags":["x_refsource_CONFIRM"],"url":"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:11d28281b879468fd1339072b83a4c08d97ff28c83ae213cfdc54d3e2a9200bc · sha256:30609a4c4c4b5135… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer