CVE-2026-30849: 
PHP vulnerability analysis and mitigation

CVE-2026-30849 is a critical authentication bypass vulnerability in the Mantis Bug Tracker (MantisBT) SOAP API affecting instances running on MySQL and compatible databases. The flaw stems from improper type checking on the password parameter, allowing an attacker who knows a victim's username to authenticate without the actual password. All MantisBT versions prior to 2.28.1 are affected; installations using non-MySQL database backends (e.g., PostgreSQL) are not vulnerable. The vulnerability was discovered by Alexander Philiotis of SynerComm, disclosed on March 23, 2026, and carries a CVSS v3.1 score of 9.8 (Critical) and a CVSS v4.0 score of 9.3 (Critical) (Github Advisory, MantisBT Advisory).

The root cause is classified as CWE-305 (Authentication Bypass by Primary Weakness): MySQL's implicit type coercion converts certain non-string values (e.g., integer 0) to a string during comparison, causing the password check in the mci_check_login() function to succeed regardless of the actual stored password. The vulnerable function in api/soap/mc_api.php did not enforce strict PHP type declarations on the $p_password parameter, so a crafted SOAP envelope supplying an integer value for the password field could satisfy MySQL's loose comparison and bypass authentication entirely. The patch (commit b349e5c) adds PHP nullable string type hints (?string) to both $p_username and $p_password parameters and replaces null values with empty strings before any comparison, preventing MySQL's implicit type coercion from being exploited (MantisBT Commit, Github Advisory). A technical write-up is available at the Shellntel blog (Shellntel Blog).

Successful exploitation allows an unauthenticated remote attacker to fully impersonate any MantisBT user — including administrators — via the SOAP API, without knowing their password. Once authenticated, the attacker can execute any SOAP API function accessible to the impersonated account, including reading and modifying bug reports, creating or escalating user accounts, and accessing sensitive project data. Even if the SOAP API is disabled as a workaround, attackers can still retrieve user account information such as email addresses and real names, posing a residual data exposure risk (Github Advisory, MantisBT Advisory).

As of the time of disclosure, no public proof-of-concept exploit code has been confirmed, though exploit references have appeared on Sploitus and Vulners (Sploitus, Vulners). There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.091–0.14%, placing it in the 34th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no privileges, no user interaction, and only knowledge of a valid username, making it highly accessible to opportunistic attackers targeting internet-exposed MantisBT instances on MySQL.

1. Reconnaissance: Identify internet-facing MantisBT instances (versions < 2.28.1) backed by MySQL using tools like Shodan or Censys, searching for MantisBT login pages or SOAP API endpoints (typically at /api/soap/mantisconnect.php).
2. Username enumeration: Obtain a valid username through public bug tracker activity (e.g., issue reporter names visible on public trackers), registration pages, or prior data exposure.
3. Craft malicious SOAP envelope: Construct a SOAP request targeting the mc_login or any authenticated SOAP function, supplying the known username and an integer value (e.g., <password xsi:type="xsd:integer">0</password>) instead of a string password in the XML payload.
4. Send the request: Submit the crafted SOAP envelope to the MantisBT SOAP API endpoint. MySQL's implicit type coercion causes the password comparison to succeed, returning a valid session token.
5. Execute API functions: Use the obtained session token to call any SOAP API function available to the impersonated user — such as reading/modifying issues, enumerating users, or (if targeting an admin account) creating new privileged accounts for persistent access (Github Advisory, MantisBT Advisory, Shellntel Blog).

• Network: Unusual SOAP requests to /api/soap/mantisconnect.php containing xsi:type="xsd:integer" or non-string type annotations in the <password> field; high volume of SOAP authentication attempts from a single IP or unusual geographic source.
• Logs: MantisBT access logs showing successful SOAP API logins from unexpected IP addresses or at unusual times; repeated SOAP login attempts with the same username but varying password field types.
• Application Behavior: Unexpected modifications to bug reports, newly created user accounts (especially with elevated privileges), or bulk data exports initiated via the SOAP API without corresponding user activity in the web UI.
• File System: New or modified files in the MantisBT installation directory that could indicate post-exploitation activity (e.g., web shells) if the attacker leveraged admin API access to upload files.

Upgrade MantisBT to version 2.28.1 or later, which contains the patch enforcing strict PHP string type checking on the mci_check_login() function's password parameter (Github Advisory, MantisBT Commit). For organizations unable to patch immediately, disabling the SOAP API significantly reduces risk but does not fully eliminate it — attackers may still retrieve user account information (email addresses, real names) through residual API exposure. Additionally, implement network-level access controls to restrict SOAP API access to trusted IP ranges only, and monitor SOAP API logs for anomalous authentication patterns.

The MantisBT project credited Alexander Philiotis of SynerComm for responsible disclosure and published the advisory and patch simultaneously on March 23, 2026 (MantisBT Advisory). Security media outlet SecurityOnline.info covered the vulnerability, highlighting its critical severity and the MySQL-specific nature of the flaw (SecurityOnline). The Shellntel blog published a technical write-up titled "Casting Spells and Data Types" detailing the exploitation mechanics (Shellntel Blog). The MantisBT vendor blog also published release announcements referencing the security fix (MantisBT Blog).