CVE-2026-13020 HIGH

CVE-2026-13020: Weak Password Recovery Mechanism in Portal for ArcGIS

Vendor Esri
Product Portal for ArcGIS
Weakness CWE-640 · Weak password recovery
Published July 7, 2026
Last update July 7, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for an administrator to reset a user’s password remains unchanged.

Key dates

02Disclosure timeline

July 7, 2026 CVE published
July 7, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-14783 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect CVE-2026-7655 SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook CVE-2025-47646 WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability CVE-2025-31380 WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability CVE-2026-61967 WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability