MantisBT SOAP `mc_issue_add` Authentication Bypass (Type Juggling) — CVE-2026-30849

Metadata

Affected Target

Summary

MantisBT’s legacy SOAP API is affected by a PHP loose-comparison (“type juggling”) flaw in password verification reachable via the mc_issue_add SOAP operation, allowing an attacker to authenticate without knowing a valid password by supplying a specially crafted password value that PHP’s == comparison treats as equal to the stored hash/value. The PoC implements both a version-detection check and a full working exploit that performs the SOAP authentication bypass and issues an authenticated mc_issue_add call.

Vulnerability Details

Root Cause

Insecure loose (==) comparison of user-supplied password values against stored credential data in MantisBT’s SOAP authentication path, exploitable via PHP type-juggling techniques (e.g. magic hash / boolean-coercion values).

Attack Vector

1. Attacker identifies a MantisBT instance exposing its SOAP API (< 2.28.1).
2. Attacker sends a SOAP request to mc_issue_add (or the underlying authentication routine it uses) with a specially crafted password value designed to loosely-equal the stored comparison value regardless of the true password.
3. PHP’s == comparison incorrectly treats the crafted value as a match, authenticating the attacker without valid credentials.
4. The attacker’s now-authenticated SOAP session can create issues (mc_issue_add) or perform other SOAP-exposed actions as the impersonated/bypassed account.

Impact

Authentication bypass against MantisBT’s SOAP API, allowing unauthorized creation/manipulation of issues and potentially further actions available to the impersonated account context.

Environment / Lab Setup

Target:   MantisBT < 2.28.1 with the SOAP API enabled
Attacker: Node.js, ts-node, npm install (project dependencies)

Proof of Concept

PoC Script

See CVE-2026-30849.ts in this folder.

1
2
3

npm install
npx ts-node CVE-2026-30849.ts check --url http://mantis.local
npx ts-node CVE-2026-30849.ts exploit --url http://mantis.local

The check command fingerprints the target’s MantisBT version via SOAP and reports whether it falls in the vulnerable range (< 2.28.1). The exploit command performs the SOAP authentication bypass via the password type-juggling technique and issues an authenticated mc_issue_add call to prove code-path access.

Detection & Indicators of Compromise

Signs of compromise:

• Issues created via the SOAP API with no corresponding legitimate user session
• SOAP authentication requests containing password fields with array/boolean-coercible values
• MantisBT audit logs showing successful SOAP logins with anomalous credential payloads

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Gumbraise/CVE-2026-30849-PoC on 2026-07-05.