---
id: CVE-2026-92796
title: >-
  Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions
  for all statements in multi-statement SQL requests, allowing read-only users
  to execute unauthorized queries
summary: >-
  Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions
  for all statements in multi-statement SQL requests, allowing read-only users
  to execute unauthorized queries. Attackers can append additional SELECT
  statements a…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
vendor: manticoresoftware
product: Manticore Search
affected:
  - manticore_search >= 27.0.0 < 28.4.4
published: '2026-09-16'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:53:07.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92796'
references:
  - url: 'https://github.com/geo-chen/oss/blob/main/manticoresearch.md'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/manticoresoftware/manticoresearch'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418
    label: disclosure@vulncheck.com
  - url: 'https://github.com/manticoresoftware/manticoresearch/issues/4706'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/manticore-search-27.0.0-before-28.4.4-multi-statement-authorization-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00523
epssPercentile: 0.41884
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T15:42:58.265122Z'
ingestedAt: '2026-09-16T21:05:36.885Z'
---

## Overview

Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.