CVE-2026-72534
Received Received - Intake

Privilege Escalation in Authentik Security

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72534
EUVD
EUVD-2026-56004

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
goauthentik authentik 2026.5.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in Authentik Security authentik up to version 2026.5.6. An attacker with a source-scoped SCIM provisioning token can exploit it by creating a SCIM group matching an existing admin group name. The system replaces the admin group's membership without checking token scope, allowing the attacker to grant themselves superuser access and lock out existing administrators.

Detection Guidance

Check authentik logs for unusual SCIM group provisioning events or modifications to administrator groups. Review SCIM token usage and group membership changes in the authentik admin interface or via API queries.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain full administrative control over your Authentik instance. This means they could access sensitive data, modify configurations, create or delete users, and disrupt services. Organizations using Authentik for identity management face potential data breaches, unauthorized access, and operational disruptions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to personal or health data. GDPR requires strict access controls and breach notification, while HIPAA mandates safeguards for protected health information. Exploitation could result in data breaches, fines, and legal penalties for failing to protect sensitive data.

Mitigation Strategies

Revoke all SCIM provisioning tokens, especially source-scoped ones. Audit and remove any unauthorized administrator groups or users. Update authentik to the latest version beyond 2026.5.6 if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72534. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart