Executive brief
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
Affected products
- PyPI ckan
Junglewise Threat Intelligence
CVE-2022-43685: PYSEC-2022-42987 - CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user
CVE-2022-43685 · Severity: low · CVSS 3.1 · Published 2022-11-22
Technologies: ckan (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1246 - CKAN vulnerable to fixed session IDs
- PYSEC-2026-1247 - CKAN vulnerable to stored XSS in resource description
- PYSEC-2026-1250 - CKAN has an XSS vector in user uploaded images in group/org and user profiles
- PYSEC-2026-1252 - Potential access to sensitive URLs via CKAN extensions (SSRF)
- PYSEC-2026-1253 - CKAN has Cross-site Scripting vector in the Datatables view plugin