CVE-2026-92796: fallo de gravedad alta en manticoresoftware Manticore Search
Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
41Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 8.7epss 0.5%
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
manticoresoftware · Manticore SearchPoCs públicas encontradas — 1
cve_referencegithub.com/geo-chen/oss/blob/main/manticoresearch.mdno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/geo-chen/oss/blob/main/manticoresearch.mdhttps://github.com/manticoresoftware/manticoresearchhttps://github.com/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418https://github.com/manticoresoftware/manticoresearch/issues/4706https://www.vulncheck.com/advisories/manticore-search-27.0.0-before-28.4.4-multi-statement-authorization-bypass