Search
Find a vulnerability
Search criteria
2 vulnerabilities by manticoresoftware
CVE-2026-92796 (GCVE-0-2026-92796)
Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-21 15:43
VLAI
EPSS
VEX
Title
Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass
Summary
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:42 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/mantico… | technical-descriptionexploit |
| https://github.com/manticoresoftware/manticoresea… | issue-tracking |
| https://github.com/manticoresoftware/manticoresea… | patch |
| https://github.com/manticoresoftware/manticoresearch | product |
| https://www.vulncheck.com/advisories/manticore-se… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| manticoresoftware | Manticore Search |
Affected:
27.0.0 , < 28.4.4
(semver)
|
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92796",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:42:58.265122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:43:07.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Manticore Search",
"vendor": "manticoresoftware",
"versions": [
{
"lessThan": "28.4.4",
"status": "affected",
"version": "27.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:50.419Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/manticoresearch.md"
},
{
"name": "GitHub Issue #4706",
"tags": [
"issue-tracking"
],
"url": "https://github.com/manticoresoftware/manticoresearch/issues/4706"
},
{
"name": "28.4.4 checks every statement in the request",
"tags": [
"patch"
],
"url": "https://github.com/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418"
},
{
"tags": [
"product"
],
"url": "https://github.com/manticoresoftware/manticoresearch"
},
{
"name": "VulnCheck Advisory: Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/manticore-search-27.0.0-before-28.4.4-multi-statement-authorization-bypass"
}
],
"title": "Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92796",
"datePublished": "2026-09-16T20:32:50.419Z",
"dateReserved": "2026-09-16T19:40:21.263Z",
"dateUpdated": "2026-09-21T15:43:07.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92796 (GCVE-0-2026-92796)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-21 15:43
VLAI
EPSS
VEX
Title
Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass
Summary
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:42 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/mantico… | technical-descriptionexploit |
| https://github.com/manticoresoftware/manticoresea… | issue-tracking |
| https://github.com/manticoresoftware/manticoresea… | patch |
| https://github.com/manticoresoftware/manticoresearch | product |
| https://www.vulncheck.com/advisories/manticore-se… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| manticoresoftware | Manticore Search |
Affected:
27.0.0 , < 28.4.4
(semver)
|
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92796",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:42:58.265122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:43:07.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Manticore Search",
"vendor": "manticoresoftware",
"versions": [
{
"lessThan": "28.4.4",
"status": "affected",
"version": "27.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:50.419Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/manticoresearch.md"
},
{
"name": "GitHub Issue #4706",
"tags": [
"issue-tracking"
],
"url": "https://github.com/manticoresoftware/manticoresearch/issues/4706"
},
{
"name": "28.4.4 checks every statement in the request",
"tags": [
"patch"
],
"url": "https://github.com/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418"
},
{
"tags": [
"product"
],
"url": "https://github.com/manticoresoftware/manticoresearch"
},
{
"name": "VulnCheck Advisory: Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/manticore-search-27.0.0-before-28.4.4-multi-statement-authorization-bypass"
}
],
"title": "Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92796",
"datePublished": "2026-09-16T20:32:50.419Z",
"dateReserved": "2026-09-16T19:40:21.263Z",
"dateUpdated": "2026-09-21T15:43:07.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}