CVE-2026-92796 is an incorrect authorization vulnerability in Manticore Search affecting versions >=27.0.0 and <28.4.4. The issue arises because the product does not validate permissions for every statement in multi-statement SQL requests. As a result, a user with read-only privileges can append additional SELECT statements after the initial query to read sensitive credential tables. This exposure allows attackers to retrieve password hashes that can be used to authenticate as administrators, bypassing intended access controls.

Exploitation of this vulnerability allows read-only users to bypass authorization controls and access sensitive credential information, including password hashes. This can lead to privilege escalation by authenticating as an administrator. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and avoid allowing multi-statement SQL queries from lower-privileged accounts. Monitor for vendor updates to apply an official fix once released.