MantisBT - Authentication Bypass (CVE-2026-30849)

CVE-2026-30849 is a critical authentication bypass vulnerability in MantisBT versions prior to 2.28.1 running on MySQL-family databases. An unauthenticated attacker who knows a victim’s username can submit a crafted SOAP envelope to access that user’s SOAP API account without their password and execute available API functions, potentially exposing sensitive information or modifying tracker data.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-30849 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2026-30849 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2026-30849 is currently experiencing high visibility and active exploitation across the internet.

Attackers target the MantisBT SOAP endpoint /api/soap/mantisconnect.php with a crafted mc_login SOAP request. The exploit uses a type-confused password parameter, such as an integer value instead of a string, to bypass authentication for a known username.