CVE-2026-92796: Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass
Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Manticore Searchto a version that resolves this vulnerability.Fixed in 28.4.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Manticore Search deployments running version 27.0.0 through versions before 28.4.4 are affected. The issue applies where a read-only user can submit multi-statement SQL requests.
What access does an attacker need?
An attacker needs valid read-only credentials and network access to submit SQL requests to the affected Manticore Search service. No user interaction is required.
What can a read-only attacker do?
They can append additional SELECT statements after an initially permitted statement, bypassing authorization checks for those later statements. This can expose credential tables and administrator-authenticating password hashes.
How can I determine whether a system may already have been targeted?
Review SQL request logs for multi-statement requests submitted by read-only accounts, particularly requests containing appended SELECT statements that access credential tables. The provided data does not identify specific log fields or indicators beyond this request pattern.