Published: October 13, 2026 | Last Modified: October 13, 2026
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.