Skip to content
Heist/ feed
Back to feed
High

Authentik Security authentik - Privilege Escalation

Type: advisorySources: OSV

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-72534
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 02:20 UTC · Revision 1

Source evidence

Authentik Security authentik - Privilege Escalation

core-osv · Original source

Published 11 Aug 2026, 11:06 UTC

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.

osv:CVE-2026-72534
Complete source record
{
  "id": "f77c0df0727d45521497a55bb6589c8dc05cfd36b3628820836ebfa1ce6319e0",
  "url": "https://osv.dev/vulnerability/CVE-2026-72534",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Authentik Security authentik - Privilege Escalation",
    "summary": "A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.",
    "evidence": "osv:CVE-2026-72534",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-72534",
      "aliases": [
        "CVE-2026-72534"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/goauthentik/authentik",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "0c67ea476be6319f1b2a41cb0f5ed128af37b99b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2026.5.6"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2026.5.6"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "version/2026.5.6",
            "version/2026.5.5",
            "version/2026.5.4",
            "version/2026.5.3",
            "version/2026.5.2",
            "version/2026.5.0",
            "version/2026.5.0-rc2",
            "version/2026.5.0-rc1",
            "version/2023.10.0",
            "version/2023.8.2",
            "version/2023.8.1",
            "version/2023.8.0",
            "version/2023.6.0",
            "version/2023.5.1",
            "version/2023.2.1",
            "version/2022.12.1",
            "version/2022.12.0",
            "version/2022.10.1",
            "version/2022.9.0",
            "version/2022.8.2",
            "version/2022.8.1",
            "version/2022.7.2",
            "version/2022.6.2",
            "version/2022.5.2",
            "version/2022.5.1",
            "version/2022.4.1",
            "version/2022.3.3",
            "version/2022.2.1",
            "version/2022.1.4",
            "version/2022.1.3",
            "version/2022.1.1",
            "version/2021.12.5",
            "version/2021.12.4",
            "version/2021.12.3",
            "version/2021.12.2",
            "version/2021.12.1",
            "version/2021.12.1-rc5",
            "version/2021.12.1-rc4",
            "version/2021.12.1-rc3",
            "version/2021.12.1-rc2",
            "version/2021.12.1-rc1",
            "version/2021.10.4",
            "version/2021.10.3",
            "version/2021.10.1-rc3",
            "version/2021.9.3",
            "version/2021.9.2",
            "version/2021.9.1",
            "version/2021.9.1-rc3",
            "version/2021.9.1-rc2",
            "version/2021.9.1-rc1",
            "version/2021.8.4",
            "version/2021.8.3",
            "version/2021.8.2",
            "version/2021.8.1",
            "version/2021.8.1-rc2",
            "version/2021.7.1",
            "version/2021.7.1-rc1",
            "version/2021.6.4",
            "version/2021.6.3",
            "version/2021.6.1",
            "version/2021.6.1-rc4",
            "version/2021.6.1-rc3",
            "version/2021.6.1-rc2",
            "version/2021.6.1-rc1",
            "version/2021.5.2",
            "version/2021.5.1",
            "version/2021.5.1-rc10",
            "version/2021.5.1-rc9",
            "version/2021.5.1-rc8",
            "version/2021.4.1",
            "version/2021.4.1-rc2",
            "version/2021.4.1-rc1",
            "version/2021.3.4",
            "version/2021.3.3",
            "version/2021.3.2",
            "version/2021.3.1",
            "version/2021.3.1-rc2",
            "version/2021.3.1-rc1",
            "version/2021.2.3-stable",
            "version/2021.2.2-stable",
            "version/2021.1.3-stable",
            "version/2021.1.2-stable",
            "version/2021.1.1-stable",
            "version/2021.1.1-rc2",
            "version/2021.1.1-rc1",
            "version/0.13.3-stable",
            "version/0.13.2-stable",
            "version/0.13.1-stable",
            "version/0.13.0-stable",
            "version/0.13.0-rc4",
            "version/0.13.0-rc3",
            "version/0.13.0-rc2",
            "version/0.13.0-rc1",
            "version/0.12.11-stable",
            "version/0.12.10-stable",
            "version/0.12.9-stable",
            "version/0.12.8-stable",
            "version/0.12.7-stable",
            "version/0.12.6-stable",
            "version/0.12.5-stable",
            "version/0.12.4-stable",
            "version/0.12.3-stable",
            "version/0.12.2-stable",
            "version/0.12.1-stable",
            "version/0.12.0-stable",
            "version/0.11.0-stable",
            "version/0.10.9-stable",
            "version/0.10.8-stable",
            "version/0.10.7-stable",
            "version/0.10.6-stable",
            "version/0.10.5-stable",
            "version/0.10.4-stable",
            "version/0.10.3-stable",
            "version/0.10.2-stable",
            "version/0.10.1-stable",
            "version/0.10.0-stable",
            "version/0.10.0-rc6",
            "version/0.10.0-rc5",
            "version/0.10.0-rc4",
            "version/0.10.0-rc3",
            "version/0.10.0-rc2",
            "version/0.10.0-rc1",
            "version/0.9.0-stable",
            "version/0.9.0-rc2",
            "version/0.9.0-rc1",
            "version/0.9.0-pre7",
            "version/0.9.0-pre6",
            "version/0.9.0-pre5",
            "version/0.9.0-pre4",
            "version/0.9.0-pre3",
            "version/0.9.0-pre2",
            "version/0.9.0-pre1",
            "version/0.8.15-beta",
            "version/0.8.14-beta",
            "version/0.8.12-beta",
            "version/0.8.11-beta",
            "version/0.8.10-beta",
            "version/0.8.9-beta",
            "version/0.8.8-beta",
            "version/0.8.7-beta",
            "version/0.8.6-beta",
            "version/0.8.5-beta",
            "version/0.8.4-beta",
            "version/0.8.3-beta",
            "version/0.8.2-beta",
            "version/0.8.1-beta",
            "version/0.8.0-beta",
            "version/0.7.17-beta",
            "version/0.7.16-beta",
            "version/0.7.15-beta",
            "version/0.7.14-beta",
            "version/0.7.13-beta",
            "version/0.7.12-beta",
            "version/0.7.11-beta",
            "version/0.7.10-beta",
            "version/0.7.9-beta",
            "version/0.7.8-beta",
            "version/0.7.7-beta",
            "version/0.7.6-beta",
            "version/0.7.5-beta",
            "version/0.7.4-beta",
            "version/0.7.3-beta",
            "version/0.7.2-beta",
            "version/0.7.1-beta",
            "version/0.7.0-beta",
            "version/0.6.3-beta",
            "version/0.6.2-beta",
            "version/0.6.1-beta",
            "version/0.6.0-beta",
            "version/0.5.0-beta",
            "version/0.4.2-beta",
            "version/0.4.1-beta",
            "version/0.4.0-beta",
            "version/0.3.0-beta",
            "version/0.2.8-beta",
            "version/0.2.7-beta",
            "version/0.2.6-beta",
            "version/0.2.5-beta",
            "version/0.2.4-beta",
            "version/0.2.3-beta",
            "version/0.2.2-beta",
            "version/0.2.1-beta",
            "version/0.2.0-beta",
            "version/0.1.38-beta",
            "version/0.1.37-beta",
            "version/0.1.36-beta",
            "version/0.1.35-beta",
            "version/0.1.34-beta",
            "version/0.1.33-beta",
            "version/0.1.32-beta",
            "version/0.1.31-beta",
            "version/0.1.30-beta",
            "version/0.1.29-beta",
            "version/0.1.28-beta",
            "version/0.1.27-beta",
            "version/0.1.26-beta",
            "version/0.1.25-beta",
            "version/0.1.24-beta",
            "version/0.1.23-beta",
            "version/0.1.22-beta",
            "version/0.1.21-beta",
            "version/0.1.20-beta",
            "version/0.1.19-beta",
            "version/0.1.18-beta",
            "version/0.1.17-beta",
            "version/0.1.16-beta",
            "version/0.1.15-beta",
            "version/0.1.14-beta",
            "version/0.1.13-beta",
            "version/0.1.12-beta",
            "version/0.1.11-beta",
            "version/0.1.10-beta",
            "version/0.1.9-beta",
            "version/0.1.8-beta",
            "version/0.1.7-beta",
            "version/0.1.6-beta",
            "version/0.1.5-beta",
            "version/0.1.4-beta",
            "version/0.1.3-beta",
            "version/0.1.2-beta",
            "version/0.1.1-beta",
            "version/0.1.0-beta",
            "version/0.0.13-alpha",
            "version/0.0.12-alpha",
            "version/0.0.11-alpha",
            "version/0.0.10-alpha",
            "version/0.0.9-alpha",
            "version/0.0.8-alpha",
            "version/0.0.7-alpha",
            "version/0.0.6-alpha",
            "version/0.0.5-alpha",
            "version/0.0.4-alpha",
            "version/0.0.3-alpha",
            "version/0.0.2-alpha"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72534.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.315926078Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72534.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-72534",
        "https://github.com/goauthentik/authentik"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-269"
        ],
        "cna_assigner": "TuranSec",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72534.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-72534",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499603,
  "published_at": "2026-08-11T11:06:44.724+00:00"
}