CVE-2022-46172

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-46172", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2022-11-28T17:27:19.998Z", "datePublished": "2022-12-28T06:16:21.985Z", "dateUpdated": "2025-04-11T15:46:38.946Z"}, "containers": {"cna": {"title": "authentik allows existing authenticated users to create arbitrary accounts", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5"}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"version": ">= 2022.11.0, < 2022.11.4", "status": "affected"}, {"version": ">= 2022.10.0, < 2022.10.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-12-28T06:16:21.985Z"}, "descriptions": [{"lang": "en", "value": "authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4."}], "source": {"advisory": "GHSA-hv8r-6w7p-mpc5", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:24:03.352Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-11T15:46:29.663612Z", "id": "CVE-2022-46172", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T15:46:38.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5", "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:24:03.352Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-46172", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-11T15:46:29.663612Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-11T15:46:34.331Z"}}], "cna": {"title": "authentik allows existing authenticated users to create arbitrary accounts", "source": {"advisory": "GHSA-hv8r-6w7p-mpc5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"status": "affected", "version": ">= 2022.11.0, < 2022.11.4"}, {"status": "affected", "version": ">= 2022.10.0, < 2022.10.4"}]}], "references": [{"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5", "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-12-28T06:16:21.985Z"}}}, "cveMetadata": {"cveId": "CVE-2022-46172", "state": "PUBLISHED", "dateUpdated": "2025-04-11T15:46:38.946Z", "dateReserved": "2022-11-28T17:27:19.998Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-12-28T06:16:21.985Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "authentik", "vendor": "goauthentik", "versions": [{"status": "affected", "version": ">= 2022.11.0, < 2022.11.4"}, {"status": "affected", "version": ">= 2022.10.0, < 2022.10.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "99BE347E-A6BA-42EA-98CE-AFAE2F5D4A37", "versionEndExcluding": "2022.10.4", "versionStartIncluding": "2022.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F1325E1-8B8D-4E34-A443-646C43280671", "versionEndExcluding": "2022.11.4", "versionStartIncluding": "2022.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4."}, {"lang": "es", "value": "authentik es un proveedor de identidad de c\u00f3digo abierto centrado en la flexibilidad y la versatilidad. En versiones anteriores a 2022.10.4 y 2022.11.4, cualquier usuario autenticado puede crear una cantidad arbitraria de cuentas a trav\u00e9s de los flujos predeterminados. Esto omitir\u00eda cualquier pol\u00edtica en una situaci\u00f3n en la que no sea deseable que los usuarios creen nuevas cuentas por s\u00ed mismos. Esto tambi\u00e9n puede afectar a otras aplicaciones, ya que estas nuevas cuentas b\u00e1sicas existir\u00edan en toda la infraestructura de SSO. De forma predeterminada, no se puede iniciar sesi\u00f3n en las cuentas reci\u00e9n creadas ya que no existe ning\u00fan restablecimiento de contrase\u00f1a. Sin embargo, es probable que la mayor\u00eda de las instalaciones habiliten el restablecimiento de contrase\u00f1as. Esta vulnerabilidad pertenece al contexto de usuario utilizado en el flujo de configuraci\u00f3n de usuario predeterminado, /api/v3/flows/instances/default-user-settings-flow/execute/. Este problema se solucion\u00f3 en las versiones 2022.10.4 y 2022.11.4."}], "id": "CVE-2022-46172", "lastModified": "2026-06-17T05:11:21.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-46172", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-11T15:46:29.663612Z", "version": "2.0.3"}}]}, "published": "2022-12-28T07:15:07.833", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}