CVE-2026-47156: 
PHP vulnerability analysis and mitigation

CVE-2026-47156 is a critical SOAP API authentication bypass vulnerability in MantisBT (Mantis Bug Tracker) titled "SOAP API Authentication Bypass with Privilege Escalation to Administrator." It affects MantisBT versions 2.28.3 and earlier, with the patch released in version 2.28.4. The vulnerability was discovered by McCaulay Hudson (@_McCaulay) of watchTowr, subsequently found independently by multiple researchers, and publicly disclosed on July 15, 2026. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The root cause lies in the mci_check_login() function in api/soap/mc_api.php, which failed to verify that a supplied cookie_string (passed as the password parameter) actually belonged to the user specified in the username parameter — classified as CWE-287 (Improper Authentication) and CWE-639 (Authorization Bypass Through User-Controlled Key). An attacker can supply any valid MANTIS_STRING_COOKIE value alongside an arbitrary target username (e.g., "administrator") in a SOAP API call; the server validates the cookie as legitimate but never checks whether it belongs to the claimed user, granting access as that user. The fix (commit e3571c3) adds a case-insensitive username comparison between the cookie's actual owner and the supplied username, rejecting mismatches. The REST API and Web UI are not affected because both derive the username server-side rather than trusting client-supplied input (GitHub Advisory, Patch Commit).

Successful exploitation grants an attacker full administrator-level access to the MantisBT SOAP API, enabling complete data exfiltration of all bug reports, attachments, user account details (IDs, names, emails), and non-private configuration values across all 71 available SOAP operations. Attackers can also perform destructive operations (deleting projects, issues, attachments, tags, categories, and versions), manipulate data (create/modify issues, impersonate reporters, manage project structure), and chain this vulnerability with other SOAP-based vulnerabilities that require administrator privileges. On default installations where self-registration is enabled ($g_allow_signup = ON), this is exploitable with zero prior access, making the effective attack surface extremely broad (GitHub Advisory, MantisBT Security Advisory).

As of the disclosure date, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (GitHub Advisory). However, the vulnerability is trivially exploitable on default installations — an attacker only needs to self-register an account, read their own MANTIS_STRING_COOKIE from the browser, and submit a crafted SOAP request with a target username. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was independently discovered by at least five researchers while the vendor was preparing the fix, suggesting broad awareness in the security research community (MantisBT Security Advisory).

1. Reconnaissance: Identify internet-facing MantisBT instances running version 2.28.3 or earlier using tools like Shodan or Censys, searching for the MantisBT web interface or SOAP endpoint (/api/soap/mantisconnect.php).
2. Self-register an account: If self-registration is enabled (the default, $g_allow_signup = ON), register a new user account on the target MantisBT instance via the web UI.
3. Obtain your own cookie_string: Log in to the newly created account via the web UI and retrieve the value of the MANTIS_STRING_COOKIE browser cookie from your session.
4. Identify the target username: Enumerate or guess the administrator username (commonly "administrator" or "admin") — this can sometimes be inferred from public issue reports or the MantisBT interface.
5. Craft a malicious SOAP request: Send a SOAP API call to the MantisBT SOAP endpoint (e.g., mc_login or any privileged operation), supplying the target administrator's username as $p_username and your own cookie_string as $p_password.
6. Achieve administrator access: The vulnerable mci_check_login() function validates the cookie as legitimate but does not verify it belongs to the supplied username, granting full administrator-level SOAP API access.
7. Exploit administrator privileges: Use the 71 available SOAP operations to exfiltrate data, delete or modify issues/projects, or chain with other SOAP vulnerabilities requiring administrator access (GitHub Advisory, MantisBT Security Advisory).

• Network: Unusual or high-volume SOAP API requests to /api/soap/mantisconnect.php from IP addresses not associated with known integrations; SOAP calls using administrator usernames originating from unexpected source IPs.
• Logs: MantisBT access logs showing SOAP API authentication events where the authenticated username (e.g., "administrator") does not match the IP or session pattern of the actual administrator; repeated SOAP login attempts with varying usernames but the same cookie value.
• Application Behavior: Unexpected bulk data exports, mass issue deletions, or project structure changes performed via the SOAP API; new user accounts created via self-registration followed immediately by SOAP API activity.
• Authentication Events: SOAP API sessions authenticated as administrator from accounts or IPs that have no prior administrative web UI activity (GitHub Advisory).

Upgrade MantisBT to version 2.28.4, which contains the fix (commit e3571c3) that validates the cookie_string belongs to the user attempting to authenticate before granting access (Patch Commit). The vendor has confirmed no workarounds are available for the vulnerability itself. As interim mitigations until patching is possible, consider: restricting network access to the SOAP API endpoint (/api/soap/mantisconnect.php) via firewall or WAF rules; disabling self-registration ($g_allow_signup = OFF) to raise the bar for exploitation; and monitoring SOAP API logs for anomalous authentication patterns (GitHub Advisory, MantisBT Security Advisory).

The vulnerability was originally reported by McCaulay Hudson (@_McCaulay) of watchTowr through responsible disclosure, and was subsequently independently discovered by four additional researchers (Keitaro Yamazaki, Harrison Keating, Chandler Johnson, and Bharat Devasani) while the MantisBT team was preparing the fix — indicating significant interest from the security research community. The MantisBT team credited all discoverers in the advisory and published the fix promptly on July 15, 2026 (MantisBT Security Advisory).