Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92796

Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass

CVSS 4.0 8.7 HIGHCVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92796

Published

Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92796

Published

Manticore Search

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "manticoresoftware",
                    "product": "Manticore Search",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "27.0.0",
                            "lessThan": "28.4.4",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON