A flaw in Esri Portal for ArcGIS permits unauthenticated users to create new accounts through the sharing endpoint even when self‑service registration is disabled. The vulnerability bypasses the intended restriction, allowing an attacker to generate accounts that would normally be blocked. This could enable the attacker to obtain access to the portal with the privileges granted to the newly created account.

Affected systems are installations of Esri’s Portal for ArcGIS. No specific product versions are listed in the advisory, so the vulnerability could potentially exist in any release that does not include the identified fix. Administrators should verify against Esri’s security bulletin for the latest patched versions.

The CVSS score of 6.5 indicates moderate severity, and the flaw is exploitable without authentication through the publicly reachable sharing endpoint. EPSS data is not available, so the current exploitation probability is unknown. The advisory does not list it in CISA KEV, but because unauthorized account creation is possible, it presents a significant risk that should be mitigated promptly. Attackers most likely target the portal over the network, sending crafted requests to the sharing endpoint to trigger the signup bypass.