CVE-2026-92796 json
Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass
published last mo. modified last mo. also EUVD-2026-81059
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
Patch / fix
- manticoresoftware Manticore Search 28.4.4
Is CVE-2026-92796 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/geo-chen/oss/blob/main/manticoresearch.md referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- manticoresoftware Manticore Search
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418
patch
-
github.com
/geo-chen/oss/blob/main/manticoresearch.md
technical-description, exploit
-
github.com
/manticoresoftware/manticoresearch/issues/4706
issue-tracking
-
github.com
/manticoresoftware/manticoresearch
product
-
vulncheck.com
/advisories/manticore-search-27.0.0-before-28.4.4-multi-statement-authorization-bypass
third-party-advisory
Sources
- CVE List CVE-2026-92796
- NVD CVE-2026-92796
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.