CVE-2026-94609

Deferred Deferred - Pending Action

Privilege Escalation in Authentik Identity Provider

Publication date: 2026-09-24

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-28

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-94609

EUVD

EUVD-2026-86279

Affected Vendors & Products

Vendor	Product	Version / Range
goauthentik	authentik	2026.2.7
goauthentik	authentik	2026.5.7
goauthentik	authentik	2026.8.2
goauthentik	authentik	to 2026.2.7 (exc)
goauthentik	authentik	to 2026.5.7 (exc)
goauthentik	authentik	to 2026.8.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in authentik allows users with delegated permissions to manage groups or users to grant superuser status or assign roles without holding the required permissions. The issue occurs because group hierarchy checks do not consistently account for inherited superuser status, and role assignments lack proper authorization validation. Only deployments delegating these management tasks to non-administrative accounts are affected.

Detection Guidance

Check authentik version with: docker exec <container_name> authentik version or kubectl exec <pod_name> -- authentik version. If version is below 2026.2.7, 2026.5.7, or 2026.8.2, the system is vulnerable. Review group membership and role assignments in authentik admin interface for unauthorized superuser grants or role changes.

Impact Analysis

An attacker with delegated group management permissions could escalate their privileges to superuser or assign roles to groups, gaining full administrative control over the authentik instance. This could lead to unauthorized access to sensitive data, system compromise, or disruption of identity management services.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized privilege escalation, potentially exposing personal or sensitive data. GDPR requires strict access controls and data protection, while HIPAA mandates role-based access to safeguard health information. Unauthorized superuser access risks non-compliance with these regulations.

Mitigation Strategies

Upgrade authentik to versions 2026.2.7, 2026.5.7, or 2026.8.2 or later using Docker-compose or Kubernetes instructions from the project's releases page.
Review and restrict delegated permissions to ensure only full administrators can manage group hierarchies, roles, and user memberships.
Audit existing group hierarchies and role assignments for unauthorized changes or superuser grants.

Hi! I’m here to help you understand CVE-2026-94609. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70