The vulnerability is in the user update API, allowing a caller who has change_user rights on a target account to assign any group through UserSerializer. Because the is_superuser flag on a group is ignored unless enable_group_superuser is set, an attacker can grant a target user a superuser group without the stricter permission checks. The result is that the target account attains administrator-equivalent privileges, violating confidentiality and integrity controls. The flaw maps to CWE‑269: Improper Privilege Management.

Open‑source identity provider authentik, maintained by goauthentik. Versions earlier than 2025.12.5, and 2026.2.0‑rc1 up to 2026.2.2, are affected. The issue was addressed in release 2025.12.5 and in 2026.2.3.

The CVSS score of 8.1 indicates high severity. The EPSS score is not available, so current public exploitation data is unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely remote, occurring via the REST API; any user with change_user privileges or permission to manage groups can exploit the flaw, making it valuable in internal threat scenarios.