# CVE-2026-30849: MantisBT - Authentication Bypass

> Live exploitation tracking for CVE-2026-30849 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-30849

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** MantisBT
- **Weaknesses:** CWE-305 (Authentication Bypass by Primary Weakness)
- **Tags:** web_application

## Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions prior to 2.28.1 running on MySQL family databases are affected by an authentication bypass vulnerability in the SOAP API, as a result of an improper type checking on the password parameter. Other database backends are not affected, as they do not perform implicit type conversion from string to integer. Using a crafted SOAP envelope, an attacker knowing the victim's username is able to login to the SOAP API with their account without knowledge of the actual password, and execute any API function they have access to. Version 2.28.1 contains a patch. Disabling the SOAP API significantly reduces the risk, but still allows the attacker to retrieve user account information including email address and real name.

## CrowdSec analysis

[CVE-2026-30849](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-30849) is a critical authentication bypass vulnerability in MantisBT versions prior to 2.28.1 running on MySQL-family databases. An unauthenticated attacker who knows a victim’s username can submit a crafted SOAP envelope to access that user’s SOAP API account without their password and execute available API functions, potentially exposing sensitive information or modifying tracker data.

CrowdSec has been tracking this vulnerability and its exploits since 17th of September 2026.

CrowdSec network observations suggest that most exploitation of CVE-2026-30849 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2026-30849 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers target the MantisBT SOAP endpoint `/api/soap/mantisconnect.php` with a crafted `mc_login` SOAP request. The exploit uses a type-confused password parameter, such as an integer value instead of a string, to bypass authentication for a known username.

## Timeline

- 2026-03-23: CVE Published. CVE-2026-30849 is published to NVD.
- 2026-09-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-30849 for the first time.
- 2026-09-17: Rule Released. CrowdSec releases a rule to detect CVE-2026-30849 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-phrq-pc6r-f6gh
- https://github.com/mantisbt/mantisbt/commit/b349e5c890eeda9bd82e7c7e14479853f8a30d9f
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-30849.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-30849) follows observed exploitation activity for CVE-2026-30849. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.