CVE-2022-46145 (GCVE-0-2022-46145)
Vulnerability from cvelistv5
Published
2022-12-02 17:12
Modified
2025-04-23 16:33
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-287 - Improper Authentication
Summary
authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.
References
Impacted products
Vendor Product Version
goauthentik authentik Version: < 2022.10.2
Version: >= 2022.11.0, < 2022.11.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:24:03.299Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf"
          },
          {
            "name": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102"
          },
          {
            "name": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-46145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:46:15.577977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:33:01.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authentik",
          "vendor": "goauthentik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2022.10.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2022.11.0, \u003c 2022.11.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-02T17:12:42.046Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf"
        },
        {
          "name": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102"
        },
        {
          "name": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112"
        }
      ],
      "source": {
        "advisory": "GHSA-mjfw-54m5-fvjf",
        "discovery": "UNKNOWN"
      },
      "title": "authentik vulnerable to unauthorized user creation and potential account takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-46145",
    "datePublished": "2022-12-02T17:12:42.046Z",
    "dateReserved": "2022-11-28T17:27:19.995Z",
    "dateUpdated": "2025-04-23T16:33:01.881Z",
    "requesterUserId": "c184a3d9-dc98-4c48-a45b-d2d88cf0ac74",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-46145\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-12-02T18:15:12.790\",\"lastModified\":\"2024-11-21T07:30:11.823\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.\"},{\"lang\":\"es\",\"value\":\"authentik es un proveedor de identidad de c\u00f3digo abierto. Las versiones anteriores a 2022.11.2 y 2022.10.2 son vulnerables a la creaci\u00f3n de usuarios no autorizados y a una posible apropiaci\u00f3n de cuentas. Con los flujos predeterminados, los usuarios no autenticados pueden crear nuevas cuentas en authentik. Si existe un flujo que permite la recuperaci\u00f3n de contrase\u00f1as verificadas por correo electr\u00f3nico, se puede utilizar para sobrescribir la direcci\u00f3n de correo electr\u00f3nico de las cuentas de administrador y hacerse cargo de sus cuentas. authentik 2022.11.2 y 2022.10.2 solucionan este problema. Como workaround, se puede crear una pol\u00edtica y vincularla al \\\"default-user-settings-flow flow\\\" con el contenido \\\"return request.user.is_authenticated\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2022.10.2\",\"matchCriteriaId\":\"9F3DA805-D8FD-4A9A-BFA8-1641B3B9F2B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2022.11\",\"versionEndExcluding\":\"2022.11.2\",\"matchCriteriaId\":\"7F5F2233-A097-4E2D-BABF-AE1947C45475\"}]}]}],\"references\":[{\"url\":\"https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf\", \"name\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102\", \"name\": \"https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112\", \"name\": \"https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T14:24:03.299Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-46145\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T15:46:15.577977Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T15:46:16.870Z\"}}], \"cna\": {\"title\": \"authentik vulnerable to unauthorized user creation and potential account takeover\", \"source\": {\"advisory\": \"GHSA-mjfw-54m5-fvjf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"goauthentik\", \"product\": \"authentik\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2022.10.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2022.11.0, \u003c 2022.11.2\"}]}], \"references\": [{\"url\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf\", \"name\": \"https://github.com/goauthentik/authentik/security/advisories/GHSA-mjfw-54m5-fvjf\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102\", \"name\": \"https://goauthentik.io/docs/releases/2022.10#fixed-in-2022102\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112\", \"name\": \"https://goauthentik.io/docs/releases/2022.11#fixed-in-2022112\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified password recovery, this can be used to overwrite the email address of admin accounts and take over their accounts. authentik 2022.11.2 and 2022.10.2 fix this issue. As a workaround, a policy can be created and bound to the `default-user-settings-flow flow` with the contents `return request.user.is_authenticated`.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287: Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-12-02T17:12:42.046Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-46145\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T16:33:01.881Z\", \"dateReserved\": \"2022-11-28T17:27:19.995Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-12-02T17:12:42.046Z\", \"requesterUserId\": \"c184a3d9-dc98-4c48-a45b-d2d88cf0ac74\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.