CVE-2026-30849 is a critical authentication bypass (CVSS 9.8) in the SOAP API of Mantis Bug Tracker before 2.28.1 on MySQL family databases. An attacker who knows a username can log in without the password. Upgrade to MantisBT 2.28.1 or later.
What's affected
MantisBT versions before 2.28.1 running on MySQL family databases are affected. The record says other database backends are not affected, because they do not perform the implicit conversion from string to integer that this bug depends on.
Version 2.28.1 contains the patch.
How to check if you're exposed
Find your MantisBT version in the footer of any page or on the admin system information page, and note which database it uses. In config/config_inc.php the $g_db_type setting names the backend.
If you run MantisBT on MySQL or MariaDB below 2.28.1, treat the instance as exposed. Also check whether the SOAP API is reachable from the internet, since the flaw is network exploitable with no privileges.
What to do now
- Upgrade MantisBT to 2.28.1 or later.
- If you cannot upgrade today, disable the SOAP API. The advisory says this significantly reduces the risk, but an attacker can still retrieve user account details such as email address and real name.
- Review access logs for unusual SOAP requests and for API activity from accounts that did not make it.
- Limit who can reach the tracker, for example with a VPN or an allowlist, until the patch is in place.
Why it matters
The weakness class is CWE-305, authentication bypass by primary weakness. The password parameter was not type checked properly. On MySQL family databases, comparing a string with an integer converts the string implicitly, so a crafted request can satisfy the password check without knowing the real password. Other backends do not convert this way, which is why they are not affected.
An attacker needs only a valid username, then acts as that user and can call any API function the account is allowed to use. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and the advisory I read does not report exploitation.
Quick check
Am I safe if I run MantisBT on PostgreSQL?
The record says other database backends are not affected by this specific bug. You should still move to 2.28.1 or later as part of normal upkeep.
Does turning off SOAP fully fix it?
No. It reduces the risk, but the advisory notes an attacker can still read account information such as email and real name. Patch as well.
Sources
Last reviewed: 19 October 2026.
