CVE-2024-27138 Apache Archiva: disabling user registration is not effective

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue...

CVE-2024-27138

The org.apache.archiva:archiva component is vulnerable to an Incorrect Authorization flaw where unauthorized users can register accounts even when the registration setting is disabled. This can lead to an Access Restriction Bypass . Because Apache Archiva is retired, no official fix will be relea...