CVE-2026-69226
MediumCVSS 6.5Summary
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.
Risk Assessment
An attacker can create unauthorized accounts in the system, potentially leading to unauthorized access to resources and data. The risk applies to Portal for ArcGIS instances with self-service registration disabled.
Recommendation
Apply available updates or patches for Portal for ArcGIS. Monitor account creation and check for unauthorized accounts.
Other vulnerabilities in Portal for ArcGIS
See all- CVE-2026-10759Medium
A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations.
- CVE-2026-69227Critical
A flaw in Portal for ArcGIS allows unauthenticated access to certain /portaladmin/local API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
Original NVD description (English source)
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS