An unauthenticated diagnostic action in the LDAP Source API fails to enforce the same object-level read‑authorization checks that other API calls use. As a result, anyone who can reach the API can trigger the diagnostic action against a configured LDAP Source and receive a small set of directory entries. The response reveals the distinguished names of those entries and the names of the attributes present, exposing the directory structure, naming conventions, and the existence of particular accounts and groups. The attacker learns only metadata; attribute values are not disclosed, but the information can be used to plan further enumeration or targeted attacks.

The issue affects installations of the open‑source identity provider goauthentik that use any LDAP Source configuration and run a version earlier than 2026.2.6 or 2026.5.5. Deployments with no configured LDAP Source are not impacted.

The vulnerability carries a CVSS score of 5.3, indicating a medium impact. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the exposed API endpoint; an attacker can reach it from inside the network or over the internet if the API is publicly accessible. Because no credentials are required, the exploit is trivial to execute once the endpoint is reachable, making it a moderate to high operational risk for affected environments.