CVE-2026-69226: Portal for ArcGIS has a security vulnerability
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Portal for ArcGIS deployments that are reachable by unauthenticated users and have self-service account registration disabled are affected by the described restriction bypass. The issue concerns account creation through the sharing endpoint.
What does an attacker need to exploit the vulnerability?
An attacker does not need an existing account or user interaction. They can manipulate the signup workflow to create an account through the sharing endpoint despite disableSignup=true.
Does disabling self-service registration mitigate the issue?
No. The vulnerability specifically allows bypassing self-service registration when it is disabled with disableSignup=true.