The CVE-2021-22214 vulnerability occurs when “Require admin approval for new sign-ups” is not checked in the settings.