The vulnerability is a critical authentication bypass in MantisBT 2.28.3 and earlier. The SOAP API's mci_check_login() accepts a valid cookie_string from a logged‑in user and will authenticate requests as the cookie's owner. An attacker who knows any valid cookie_string can impersonate any other user, including the administrator, without needing the target’s password. The flaw combines an authentication bypass (CWE-287) with privilege escalation (CWE-639).

Affected systems are installations of MantisBT up to and including version 2.28.3, hosted by any vendor or self‑hosted. The vulnerability does not affect the REST API or the web UI, which validate sessions server‑side. The default configuration of MantisBT enables self‑registration, allowing a freshly registered user to generate a cookie_string immediately, thereby making the flaw exploitable with zero prior access.

The CVSS score of 9.3 indicates a high‑severity flaw, and the absence of an EPSS score does not diminish the threat. Because the flaw can be leveraged from any point that can send a SOAP request with a legitimate cookie, an attacker can rapidly elevate privileges to the administrator role. The vulnerability is not listed in the CISA KEV catalog, but its high score and the ease of exploitation justify treating it as critical. No workaround is available, so the only mitigation is to patch to version 2.28.4 or newer.