The vulnerability lies in the group hierarchy checks and role assignment logic within authentik. An account that has been delegated the ability to manage groups, group membership, or users can misuse that delegated permission to grant itself superuser status or to assign an existing role to any group, bypassing the authorization checks that normally protect these operations. This flaw constitutes an improper privilege management weakness (CWE‑269) and lack of enforcement of role assignment controls (CWE‑863), leading to unauthorized elevation of privileges.

Affected deployments run authentik prior to version 2026.2.7, 2026.5.7, or 2026.8.2 and have intentionally delegated group or user management tasks to accounts that are not full administrators. The product vendor, goauthentik, publishes the fixes in the corresponding 2026.2.7, 2026.5.7, and 2026.8.2 releases.

The CVSS score of 8.8 rates this flaw as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires legitimate credentials with delegated group or user management rights and can be performed via the web interface or API, so the attack vector is remote. Once exploited, the attacker gains unrestricted superuser privileges, enabling full system compromise. Given the scope and impact, the failure to apply a patch poses a significant risk to any affected installation.