MantisBT 2.28.3 and earlier suffer from a critical authentication bypass in the SOAP API's mci_check_login() function. An attacker with a valid cookie_string from any user can impersonate any other user by specifying their username, including administrators, without needing their password. This is particularly severe on default installations where self-registration is enabled, allowing an attacker to create an account, obtain a valid cookie_string, and escalate privileges to administrator via the SOAP API. The REST API and Web UI are unaffected due to different authentication mechanisms. The vulnerability enables full administrator privileges on the SOAP API, including reading and modifying all issues, user data, and project configurations, as well as destructive actions like deleting projects and issues. The vulnerability was fixed in MantisBT version 2.28.4.

Exploitation allows an unauthenticated attacker (with only a valid cookie_string from any user) to impersonate any user, including administrators, on the SOAP API. This leads to full administrator access, enabling complete read and write access to all issues, including private ones, user accounts, attachments, and project configurations. Attackers can perform destructive operations such as deleting projects, issues, and other entities, as well as manipulate data and impersonate reporters. This also facilitates chaining with other vulnerabilities requiring administrator privileges. The REST API and Web UI are not impacted.

An official fix is available in MantisBT version 2.28.4. Users should upgrade to version 2.28.4 or later to remediate this vulnerability. No workarounds are available. The vendor advisory confirms the patch and recommends upgrading.