The vulnerability resides in the SOAP API of MantisBT versions before 2.28.1 when running against MySQL databases. An improper type check on the password field permits an attacker who knows a victim's username to craft a SOAP envelope that bypasses authentication, allowing login with any account without knowing its real password. Once authenticated, the attacker can execute any SOAP API function allowed to that user, potentially compromising data integrity and confidentiality. The weakness corresponds to CWE‑305, which deals with improper authorization during input validation.

Mantis Bug Tracker from the MantisBT vendor, specifically any release prior to 2.28.1 that uses a MySQL backend. The 2.28.1 release contains a patch that addresses this issue. Versions using other database backends are not affected because they do not perform the same implicit type conversion from string to integer.

The CVSS score is 9.3, indicating high severity. EPSS is below 1 %, suggesting current exploit activity is limited, but the vulnerability has not been listed in CISA's KEV catalog. Attackers likely target exposed SOAP endpoints over the network, needing only a known username to trigger the bypass. Because the SOAP API remains functional even after disabling it, the attacker can still gather user account information such as email and real name, which may aid further attacks.