UpHeron
All vulnerabilities

Servers and applications

CVE-2022-46172

Existing Authenticated Users can Create Arbitrary Accounts

Severity
Medium 6.4
Published
23 Dec 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2022.10.3, 2022.10.4, 2022.11.3, 2022.11.4
Also known as
GHSA-hv8r-6w7p-mpc5
Sources
NVD, Project advisories (GitHub)

Description

authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new…

Affected software

SoftwareAffected versions
authentikServers and applications · cpe:a:goauthentik:authentik
  • From 2022.10.0 before 2022.10.4
  • From 2022.11.0 before 2022.11.4
authentikServers and applications · github:goauthentik/authentik
  • Every version before 2022.11.3
  • Every version before 2022.10.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-46172
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-46172
  • GitHub Advisory Database https://github.com/advisories/GHSA-hv8r-6w7p-mpc5
  • github.com https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5