CVE-2026-47156 – MantisBT

CVSS 9.3 CRITICAL [2] Critical – Same Day Deployment

“When one self-registered account can become the administrator, every open signup page is a front door to your entire bug tracker.”

MantisBT version 2.28.4 fixes a critical authentication bypass in the SOAP API of the open source bug tracker. CVE-2026-47156 has a CVSS score of 9.3, Critical severity. The flaw sits in the mci_check_login() function: any user who holds a valid cookie string can sign in as any other user, including the administrator, using only that user's username. The attacker never needs the target's password.

Default installations are exposed with no prior access, because self-registration is on by default. An attacker can create an account, take their own cookie string from the browser, and impersonate the administrator through the SOAP API. The REST API and the Web UI are not affected. No workarounds exist, so upgrading to 2.28.4 is the only fix.

Key Details

CWE Classification: CWE-287

Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.