{"items":[{"id":"NVI-00006807","kind":"vulnerability","title":"MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c2xg-qjqw-2v98","CVE-2026-47156"],"plain_summary":"OSV carries this publisher advisory for mantisbt/mantisbt. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.28.4 for mantisbt/mantisbt. Confirm the publisher’s latest guidance.","source_ids":["sr-c33910acbc7dc3c21c0511d898c09563"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-22d824aeadfd26caaf2096d5c201ff42"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.686%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.52659. Missing scores are unknown.","source_id":"sr-22d824aeadfd26caaf2096d5c201ff42"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-c33910acbc7dc3c21c0511d898c09563","url":"https://github.com/advisories/GHSA-c2xg-qjqw-2v98","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-c2xg-qjqw-2v98","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.693Z"},{"id":"sr-22d824aeadfd26caaf2096d5c201ff42","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-47156","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.280Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-c33910acbc7dc3c21c0511d898c09563"],"technology":"mantisbt/mantisbt","known_exclusions":[],"conditions_summary":"MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password.\n\nThe vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API.\n\nThe REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed.\n\nThe Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client.\n\n### Impact\n- Full administrator access to the SOAP API from zero prior access (with self-registration enabled, which is the default)\n- R","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.28.4"]}],"null_published_at":"2026-11-04T18:04:03.178Z","source_updated_at":"2026-07-15T17:11:43.600Z","source_disclosed_at":"2026-07-15T16:45:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.693Z"},{"id":"NVI-00006807","kind":"vulnerability","title":"MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c2xg-qjqw-2v98","CVE-2026-47156"],"plain_summary":"OSV carries this publisher advisory for mantisbt/mantisbt. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.28.4 for mantisbt/mantisbt. Confirm the publisher’s latest guidance.","source_ids":["sr-c33910acbc7dc3c21c0511d898c09563"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-433514109ab9de8571811507fde29b89"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.686%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.52665. Missing scores are unknown.","source_id":"sr-433514109ab9de8571811507fde29b89"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-c33910acbc7dc3c21c0511d898c09563","url":"https://github.com/advisories/GHSA-c2xg-qjqw-2v98","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-c2xg-qjqw-2v98","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.693Z"},{"id":"sr-433514109ab9de8571811507fde29b89","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-47156","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.379Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-c33910acbc7dc3c21c0511d898c09563"],"technology":"mantisbt/mantisbt","known_exclusions":[],"conditions_summary":"MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password.\n\nThe vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API.\n\nThe REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed.\n\nThe Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client.\n\n### Impact\n- Full administrator access to the SOAP API from zero prior access (with self-registration enabled, which is the default)\n- R","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.28.4"]}],"null_published_at":"2026-10-31T23:18:17.225Z","source_updated_at":"2026-07-15T17:11:43.600Z","source_disclosed_at":"2026-07-15T16:45:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.693Z"},{"id":"NVI-00006807","kind":"vulnerability","title":"MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c2xg-qjqw-2v98","CVE-2026-47156"],"plain_summary":"OSV carries this publisher advisory for mantisbt/mantisbt. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.28.4 for mantisbt/mantisbt. Confirm the publisher’s latest guidance.","source_ids":["sr-c33910acbc7dc3c21c0511d898c09563"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-c33910acbc7dc3c21c0511d898c09563","url":"https://github.com/advisories/GHSA-c2xg-qjqw-2v98","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-c2xg-qjqw-2v98","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.693Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-c33910acbc7dc3c21c0511d898c09563"],"technology":"mantisbt/mantisbt","known_exclusions":[],"conditions_summary":"MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci_check_login() function. Any user knowing any valid cookie_string can authenticate as any other user (knowing their username), including the administrator, without knowing the target's password.\n\nThe vulnerability is exploitable with zero prior access on default MantisBT installations because self-registration is enabled by default ($g_allow_signup = ON). A self-registered user can use their own cookie_string (readable from their browser's MANTIS_STRING_COOKIE cookie after login) to impersonate the administrator via the SOAP API.\n\nThe REST API is NOT affected. The REST API's AuthMiddleware derives the username server-side from the API token or session cookie, so the username cannot be spoofed.\n\nThe Web UI is NOT affected. The Web UI authenticates via PHP session cookies (PHPSESSID) and validates the MANTIS_STRING_COOKIE against the logged-in user through auth_is_cookie_valid(). The username is derived server-side from the cookie, not supplied by the client.\n\n### Impact\n- Full administrator access to the SOAP API from zero prior access (with self-registration enabled, which is the default)\n- R","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 2.28.4"]}],"null_published_at":"2026-10-31T22:13:10.086Z","source_updated_at":"2026-07-15T17:11:43.600Z","source_disclosed_at":"2026-07-15T16:45:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:10.693Z"}],"next_cursor":null,"snapshot_revision":"42594"}