CVE-2026-69226

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Account Creation in Portal for ArcGIS

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Environmental Systems Research Institute, Inc.

Description

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-69226

EUVD

EUVD-2026-98845

Affected Vendors & Products

Vendor	Product	Version / Range
Esri	Portal	for ArcGIS 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Portal for ArcGIS allows unauthenticated users to create new accounts via the sharing endpoint even when self-service registration is disabled. An attacker can bypass the disableSignup=true setting by manipulating the signup workflow, leading to unauthorized account creation.

Impact Analysis

Unauthorized account creation could allow attackers to gain access to the system, potentially leading to data breaches, misuse of resources, or further exploitation of the platform. It undermines access controls and may enable malicious activities within the system.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and user authentication, such as GDPR (data protection) or HIPAA (health information security). Unauthorized account creation may lead to unauthorized data access, breaching regulatory obligations.

Mitigation Strategies

Disable the sharing endpoint if not required. Review and restrict access to account creation endpoints. Apply patches or updates from Esri as soon as they are available.

Hi! I’m here to help you understand CVE-2026-69226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70