CVE-2026-69226
6.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-863
Impact
Unauthenticated attackers can register unauthorized accounts on Portal for ArcGIS via network requests to the sharing endpoint. They do not need prior credentials or user interaction, bypassing the disableSignup configuration.
Root cause
Improper authorization logic in the sharing endpoint allows users to complete the signup workflow despite disableSignup=true.
Affected systems
Portal for ArcGIS (specific versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Install the September 2026 security patch from Esri. As an interim workaround, restrict external network access to the Portal for ArcGIS sharing API endpoint or use a reverse proxy to block unauthorized signup requests.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.