CVE-2026-72537
HighCVSS 8.8Summary
A privilege escalation vulnerability in Authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries.
Risk Assessment
Risk of full account takeover of administrators and system integrity compromise. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.
Recommendation
Upgrade Authentik to a patched version. Additionally, restrict trust in SCIM tokens and monitor provisioning activity.
Original NVD description (English source)
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.