CVE-2026-47156: MantisBT SOAP API Auth Bypass Vulnerability

CVE-2026-47156 Overview

CVE-2026-47156 is a critical authentication bypass vulnerability in MantisBT, an open source bug tracker. The flaw resides in the mci_check_login() function of the SOAP API in versions 2.28.3 and earlier. Any authenticated user who knows a valid cookie_string can impersonate any other user, including the administrator, by supplying that user's username without knowing their password. Because self-registration ($g_allow_signup = ON) is enabled by default, an unauthenticated attacker can register an account, retrieve their own MANTIS_STRING_COOKIE value, and escalate to administrator through the SOAP endpoint. The REST API and Web UI are not affected. MantisBT version 2.28.4 contains the patch.

Critical Impact
Zero-prior-access attackers can achieve full administrator takeover on default MantisBT installations through the SOAP API.

Affected Products

MantisBT versions 2.28.3 and earlier
MantisBT SOAP API (api/soap/mc_api.php)
Default installations with $g_allow_signup = ON

Discovery Timeline

2026-09-09 - CVE-2026-47156 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-47156

Vulnerability Analysis

The vulnerability is an Improper Authentication flaw [CWE-287] in the SOAP API login handler. The mci_check_login() function accepts a username and a password parameter. When the password value matches any valid cookie_string in the mantis_user_table, the function treats the caller as authenticated for the supplied username. The function fails to verify that the resolved cookie owner matches the username the caller claims to be. This allows an attacker who possesses any valid cookie value to authenticate as an arbitrary account, including the administrator.

Self-registration is enabled by default, so an attacker can create a low-privilege account, read the MANTIS_STRING_COOKIE value from their own browser after login, and then invoke SOAP methods with the administrator's username paired with their own cookie string.

Root Cause

The login path calls auth_user_id_from_cookie() to resolve a user identity from the supplied cookie value, but it never compares the resolved identity against the username submitted in the request. The trust boundary assumes cookie possession implies identity ownership, which breaks the one-to-one binding between credentials and accounts.

Attack Vector

The attack is remote, requires no prior privileges beyond the ability to register, and needs no user interaction. An attacker registers an account, extracts their own cookie_string, and issues a SOAP request such as mc_project_get_users or any SOAP method requiring authentication with the target administrator's username and their own cookie value as the password. The SOAP endpoint accepts the request and executes actions in the administrator's security context.

php

		# User cookie
		$t_user_id = auth_user_id_from_cookie( $p_password );
		if( $t_user_id !== false ) {
-			# Cookie is valid
+			# Cookie is valid - does it belong to the user trying to log in ?
+			if( 0 != strcasecmp( user_get_username( $t_user_id ), $p_username ) ) {
+				return false;
+			}
			if( auth_attempt_script_login( $p_username ) === false ) {
				return false;
			}

Source: GitHub Commit e3571c3. The patch adds a case-insensitive comparison between the username derived from the cookie and the username supplied in the request, rejecting the login when they differ.

Detection Methods for CVE-2026-47156

Indicators of Compromise

SOAP API requests to api/soap/mc_api.php where the authenticated username differs from the account associated with recent Web UI logins from the same client IP.
New administrator-level actions (user creation, permission changes, project deletion) originating from SOAP calls shortly after a self-registration event.
Repeated SOAP authentication attempts iterating usernames such as administrator or admin from a single source.

Detection Strategies

Enable and review MantisBT audit logs for administrative actions performed through SOAP endpoints.
Correlate MANTIS_STRING_COOKIE reuse across differing usernames within web server access logs.
Alert on any SOAP call authenticating as a privileged account from an IP that also authenticated as a low-privilege account in the same session window.

Monitoring Recommendations

Ingest MantisBT application and web server logs into a centralized logging platform and flag SOAP requests to mc_api.php.
Track user account creation events followed by privileged operations within a short time window.
Monitor for changes to $g_allow_signup and unexpected administrator account additions.

How to Mitigate CVE-2026-47156

Immediate Actions Required

Upgrade MantisBT to version 2.28.4 or later, which contains the official patch.
Disable self-registration by setting $g_allow_signup = OFF in config_inc.php until patching is complete.
Rotate cookie_string values for all users by forcing password resets, invalidating any cookies an attacker may have harvested.
Audit the mantis_user_table and administrator accounts for unauthorized additions or privilege changes.

Patch Information

MantisBT 2.28.4 introduces the fix in api/soap/mc_api.php by validating that the username resolved from auth_user_id_from_cookie() matches the username supplied in the SOAP login request. Details are available in the GitHub Security Advisory GHSA-c2xg-qjqw-2v98 and the MantisBT Bug Report #37121.

Workarounds

No official workaround exists. Block network access to api/soap/mc_api.php at the reverse proxy or web application firewall if immediate patching is not possible.
Restrict SOAP API access to trusted source IP ranges via web server ACLs.
Disable the SOAP API entirely if the deployment relies solely on the REST API or Web UI.

bash

# Example nginx block to disable the SOAP API until patched
location ~ ^/api/soap/mc_api\.php$ {
    deny all;
    return 403;
}

# MantisBT configuration to disable self-registration
# In config/config_inc.php
$g_allow_signup = OFF;