Improper Authentication in MantisBT - CVE-2026-47156
Published: November 6, 2026
Vulnerability identifier: #VU159816
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47156
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to gain administrator access to the MantisBT SOAP API and read, modify, or delete project data.
The vulnerability exists due to SOAP authentication accepting a valid cookie string without binding it to the supplied username. An unauthenticated remote attacker can self-register when signup is enabled, as it is by default, and submit their own cookie with a known administrator username to impersonate the administrator without their password.
Affected software
MantisBT
How to mitigate CVE-2026-47156
Install security update from vendor's website.
MantisBT - update to 2.28.4