Executive brief
Manticore Search is an open-source search database used for full-text and vector search with SQL query support. A permission validation flaw allows read-only users to bypass access controls and execute unauthorized SQL statements, including accessing sensitive credential tables and obtaining administrator password hashes. This enables attackers to escalate privileges and take over the search system without needing plaintext passwords.
Technical details
The vulnerability is an authorization bypass in Manticore Search's SQL query parser. When processing multi-statement SQL requests, the application validates permissions only for the first statement but fails to check permissions for subsequent statements appended to the same request. A read-only authenticated user can craft a request containing a permitted statement followed by a secondary SELECT statement targeting credential tables, allowing extraction of password hashes and authentication as an administrator. The flaw affects versions 27.0.0 through 28.4.3; version 28.4.4 and later include the fix. The attack requires valid database credentials but no special network access.
Affected products
- Manticore Software Manticore Search 27.0.0 to 28.4.3
Timeline
- 2026-09-16: disclosed