Authentik Security authentik - Privilege Escalation
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Authentik Security | authentik | up to 2026.5.6 | — | No fix listed | CNA |
- authentik VendorAuthentik Security Affected up to 2026.5.6 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-72534
- 2026-10-03 Alias added: GHSA-phh7-mppp-4jx8
References
Other 1
More Authentik Security vulnerabilities
- TI-2026-50797 Authentik Security authentik - Privilege Escalation CVSS 3.1HIGH 8.8
Sources
- CVE-2026-72534 · CVE Program
- CVE-2026-72534 · NVD
- FIRST EPSS
- GHSA-phh7-mppp-4jx8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences