title: Apache Archiva: disabling user registration is not effective
description: ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva.
Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer
problem types: CWE-863 Incorrect Authorization
affected:
{
defaultStatus: unaffected
product: Apache Archiva
vendor: Apache Software Foundation
versions:
lessThanOrEqual: *, status: affected, version: 2.0.0, versionType: semver
}
metrics:
other: [
content: {'text': 'moderate'}
type: Textual description of severity
]