CVE-2026-72534 in Authentik
Summary
by MITRE • 08/11/2026
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This privilege escalation vulnerability exists within Authentik Security authentik version 2026.5.6 and earlier, representing a critical security flaw that allows attackers with source-scoped SCIM provisioning tokens to escalate their privileges to superuser level. The vulnerability stems from improper validation mechanisms within the SCIM group ingestion process, where the system automatically adopts existing groups by name without verifying whether the source scope of the provisioning token aligns with the target group's permissions or administrative boundaries. This design flaw creates a dangerous condition where unauthorized actors can manipulate group memberships to gain elevated privileges.
The technical implementation of this vulnerability occurs through the SCIM group provisioning functionality, which is designed to synchronize identity information between external systems and Authentik's identity management platform. When an attacker provisions a SCIM group with a name that matches an existing administrator group within the system, the ingestion function performs a direct replacement of the target group's membership without performing scope validation checks. This behavior violates fundamental security principles of least privilege and proper access control enforcement, as demonstrated by the common weakness enumeration CWE-284 which addresses inadequate access control mechanisms. The vulnerability essentially allows for arbitrary group takeover through name matching alone, bypassing all normal authentication and authorization controls.
The operational impact of this vulnerability is severe and far-reaching, as it enables complete compromise of the identity provider system. Attackers can not only gain superuser privileges but also effectively lock out existing administrators by replacing their group memberships with their own controlled accounts. This creates a situation where legitimate administrators lose access to the system entirely while the attacker maintains full control over all identity management functions. The implications extend beyond simple privilege escalation, as this vulnerability can be exploited to modify user permissions, access sensitive data, manipulate authentication flows, and potentially compromise the entire identity infrastructure. According to the mitre att&ck framework, this represents a privilege escalation technique that leverages identity management system weaknesses to achieve persistent access and control over critical infrastructure components.
The mitigation strategy for this vulnerability requires immediate implementation of enhanced validation mechanisms within the SCIM provisioning process, specifically enforcing source scope validation against target group permissions before any membership modifications occur. Organizations should implement strict controls around SCIM token usage, ensuring that provisioning tokens are granted minimal necessary scopes and that cross-group name matching operations require explicit permission validation. Security teams must also establish monitoring procedures to detect unauthorized group membership changes and implement proper audit logging for all identity management operations. Additionally, regular security assessments should be conducted to identify similar vulnerabilities in other identity management components, as this flaw demonstrates the importance of validating all external inputs against internal access control policies to prevent unauthorized privilege escalation attacks that can completely compromise system integrity and availability through seemingly simple name-based matching mechanisms.