Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL
    family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an
    improper type checking on the password parameter. Other database backends are not affected, as they do not
    perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker
    knowing the victim's username is able to login to the SOAP API with their account without knowledge of the
    actual password, and execute any API function they have access to. Version 2.28.1 contains a patch.
    Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user
    account information including email address and real name. (CVE-2026-30849)

The version of MantisBT installed on the remote host is prior to 2.28.1. It is, therefore, affected by a vulnerability:

  - An authentication bypass vulnerability exists in the SOAP API due to improper type checking on the password     parameter when running on MySQL family databases. Using a crafted SOAP envelope, an attacker knowing the     victim's username is able to login to the SOAP API without knowledge of the actual password and execute any     API function they have access to. (CVE-2026-30849)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
439129	SCA: security update for mantisbt/mantisbt (GHSA-phrq-pc6r-f6gh)	Tenable Cloud Security	SCA Checks	critical
439129	SCA: security update for mantisbt/mantisbt (GHSA-phrq-pc6r-f6gh)	Tenable Self-Hosted Container Security	SCA Checks	critical
303449	MantisBT < 2.28.1 SOAP API Authentication Bypass (GHSA-phrq-pc6r-f6gh)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2026-30849

critical

Tenable Plugins

critical

critical

critical