CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| ckan(PyPI) | 0 | 2.9.7 | N/A |
CVSS Metrics
