<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div><p>Date: 29. 01. 2024<br>Severity: High (CVSS 8.0)<br>Affected versions: 4.8<br>Fixed in versions: 4.8.1</p><p></p><div><p id="description">Description</p><div><div>If the invitation registration is was configured along with custom registration form or object template which generated name property, user which was not invited was able to register even without invitation email.</div></div></div><div><p id="severity-and-impact">Severity and Impact</p><div><div>This is High Severity Issue.</div><div>The invitation feature is turned off by default, only specific configuration combination (invitation flow and custom form with name property) is needed to expose this vulnerability.</div></div></div><div><p id="mitigation">Mitigation</p><div><div>Users of affected MidPoint versions are advised to upgrade their deployments to the latest maintenance release 4.8.1.</div><div>In the meantime users are advised to disable invitation registration or remove name property from custom registration form.<br><div><div><div><div>This <span id="DWT108">advisory</span> is also available at https://docs.evolveum.com/midpoint/reference/security/advisories/021-not-invited-user-able-to-register/<br><br><pre>--
Anton Tkáčik
Software Developer
evolveum.com</pre></div></div></div></div><div><br data-mce-bogus="1"></div></div></div></div><p></p></div></div></body></html>