Description
engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.
Remediation
References
Related Vulnerabilities
WordPress Plugin Ultimate Reviews PHP Object Injection (2.0.18)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1240)
WordPress Plugin Browser Screenshots Cross-Site Scripting (1.7.5)
Ruby Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-3655)