A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account… (CVE-2026-69226)

CVE-2026-69226 describes a security flaw in Portal for ArcGIS where unauthenticated attackers can create new user accounts through the sharing endpoint despite self-service account registration being disabled (disableSignup=true). The vulnerability arises from the ability to manipulate the signup workflow, circumventing the restriction intended to prevent unauthorized account creation. This could allow attackers to gain unauthorized access by creating accounts without proper authorization.

The vulnerability allows unauthorized account creation by unauthenticated users, potentially enabling attackers to gain access to the system with newly created accounts. The impact is limited to confidentiality and integrity with no availability impact, as indicated by the CVSS vector (C:L/I:L/A:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider additional access controls or monitoring around account creation endpoints if feasible.