{"action":"Upgrade ckan to 2.9.7 or later.","affected":[{"fixed":"2.9.7","introduced":"0"}],"component":"ckan","cve_ids":["CVE-2022-43685"],"ecosystem":"PyPI","epss":0.00745,"exploited":false,"fixed_versions":["2.9.7"],"ghsa_id":"GHSA-m2xp-jxfg-qq6g","id":"tcs_01M5KGH9DS5YR5P7HHGA5TWT8C","modified_at":"2026-06-10T17:00:44.794441325Z","published_at":"2022-11-22T01:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2022-42987","https://ckan.org/","https://ckan.org/blog/get-latest-patch-releases-your-ckan-site-october-2022","https://github.com/advisories/GHSA-m2xp-jxfg-qq6g"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2022-42987","url":"https://osv.dev/vulnerability/PYSEC-2022-42987"}],"summary":"CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser account"}