Description
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.
Published: 2026-08-11
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A source‑scoped SCIM provisioning token can be used to provision SCIM users that match existing local accounts by username. The ingest function accepts such users without validating the token’s scope boundaries, allowing the attacker to create or modify any local account, including superusers. The flaw is an improper authorization weakness (CWE‑269) that enables attackers to undermine application security and take full control of the system.

Affected Systems

Authentik Security authentik versions up to and including 2026.5.6 are affected.

Risk and Exploitability

The vulnerability has a CVSS score of 8.8, indicating high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves interacting with the SCIM provisioning API using a token that has been granted a limited, but improperly enforced, scope—an attacker can therefore submit a crafted SCIM request over an authenticated channel to manipulate any user account.

Generated by OpenCVE AI on August 11, 2026 at 17:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update authentik to the latest version that contains the remediation for this issue
  • Revoke or delete any source‑scoped SCIM provisioning tokens that are not needed
  • Restrict newly created SCIM tokens to read‑only or limited scopes, ensuring that only authorized actions can be performed
  • Implement audit logging for all SCIM provisioning requests and review logs regularly for anomalous activity

Generated by OpenCVE AI on August 11, 2026 at 17:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/goauthentik/authentik cve-icon cve-icon
History

Tue, 11 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.
Title Authentik Security authentik - Privilege Escalation
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-11T12:40:39.574Z

Reserved: 2026-08-10T10:32:49.080Z

Link: CVE-2026-72537

cve-icon Vulnrichment

Updated: 2026-08-11T12:40:21.853Z

cve-icon NVD

Status : Received

Published: 2026-08-11T12:17:38.977

Modified: 2026-08-11T13:19:02.377

Link: CVE-2026-72537

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T17:15:06Z

Weaknesses
  • CWE-269

    Improper Privilege Management