CVE-2022-43685: Okfn Ckan

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.

Affected products

• Okfn Ckan: before 2.8.12 (fixed in 2.8.12); from 2.9.0, before 2.9.7 (fixed in 2.9.7)

Published 2022-11-22. Last modified 2026-06-17.