CVE-2026-30849
CriticalSummary
Mantis Bug Tracker (MantisBT) w wersjach przed 2.28.1, działających na bazach danych rodziny MySQL, ma podatność na obejście uwierzytelniania w API SOAP z powodu niewłaściwego sprawdzania typu parametru hasła. Atakujący, znając nazwę użytkownika ofiary, może zalogować się do API SOAP bez znajomości hasła i wykonać dowolną funkcję API, do której ma dostęp.
Risk Assessment
Podatność ta stwarza poważne ryzyko dla organizacji, ponieważ umożliwia atakującym dostęp do kont użytkowników oraz ich danych osobowych, takich jak adres e-mail i prawdziwe imię. Wyłączenie API SOAP znacznie zmniejsza ryzyko, ale nie eliminuje go całkowicie.
Recommendation
Zaleca się aktualizację do wersji 2.28.1 lub nowszej, która zawiera poprawkę. Dodatkowo, rozważ wyłączenie API SOAP, aby zminimalizować ryzyko związane z tą podatnością.
Related vulnerabilities
- CVE-2026-7826Critical
A vulnerability in FalkorDB before 4.18.4 causes a heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function. A remote attacker who can issue Redis replication commands (e.g., against an instance with no password) can send a crafted RDB stream with a sub-buffer length field exceeding the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.
- CVE-2026-5759Critical
A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders in FalkorDB before 4.18.1. A remote attacker who can issue Redis replication commands can send a crafted RDB stream where the deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.
- CVE-2026-96207Critical
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-94510Critical
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-88131Critical
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
- CVE-2026-77900Critical
Missing authentication for a critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
- CVE-2026-69435Critical
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
- CVE-2026-84249Critical
IBM Guardium Data Protection 12.2 and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for a critical function.
- CVE-2026-80381Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
- CVE-2026-75875Critical
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
Original NVD description (English source)
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS