Vulnerability · Published Aug 11, 2026 · Assigned by TuranSec
CVE-2026-72534Authentik Security authentik - Privilege Escalation
High 8.8
In plain English
A high-severity privilege mismanagement in authentik from Authentik Security. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Authentik Security | authentik | 0 – through 2026.5.6 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H