CVE-2026-72534
HighCVSS 8.8Summary
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group.
Risk Assessment
Risk of full takeover of the IdP system, including locking out all administrators. An attacker can gain full superuser access and prevent administration.
Recommendation
Upgrade Authentik to a patched version. Restrict trust in SCIM tokens and monitor changes to administrator groups.
Original NVD description (English source)
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.