CVE-2026-72537 in Authentik
Summary
by MITRE • 08/11/2026
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This privilege escalation vulnerability exists within Authentik Security authentik versions up to 2026.5.6 and represents a critical authorization flaw that allows attackers with limited SCIM provisioning credentials to gain full control over user accounts including administrative superusers. The vulnerability stems from improper validation of scope boundaries during SCIM user provisioning operations where the system blindly adopts existing local accounts based solely on username matching without verifying that the provisioning token has appropriate permissions for the target account. This design flaw creates a path for attackers to exploit the SCIM provisioning functionality and assume control over any user account within the system regardless of their original privileges or scope limitations.
The technical implementation of this vulnerability involves the SCIM user ingestion function which operates under the assumption that username uniqueness guarantees proper account identification. When an attacker presents a source-scoped SCIM provisioning token, the system performs a lookup for existing local users by username and automatically adopts the matching account without validating whether the token's scope permits modification of that particular user. This behavior creates a direct path for privilege escalation where attackers can manipulate accounts beyond their intended authorization boundaries. The vulnerability specifically affects the SCIM provisioning mechanism and falls under CWE-284 which addresses improper access control, while also demonstrating characteristics of CWE-862 which deals with missing authorization checks.
The operational impact of this vulnerability is severe as it allows attackers to perform arbitrary modifications on any user account within the system including sensitive administrative accounts. An attacker with only a source-scoped SCIM provisioning token can delete or modify any existing user account, including superuser accounts, effectively granting them complete administrative control over the Authentik instance. This capability enables unauthorized access to all system resources, data manipulation, privilege escalation, and potential persistence mechanisms that could be used for long-term unauthorized access. The vulnerability undermines the core security model of the system by allowing scope-limited credentials to bypass authorization controls and perform actions on accounts outside their intended scope boundaries.
Mitigation strategies should focus on implementing proper scope validation during SCIM user provisioning operations where the system must verify that the provisioning token has appropriate permissions for any existing local account being adopted. The implementation should enforce strict boundary checks that prevent source-scoped tokens from modifying accounts beyond their authorized scope, requiring explicit permission validation before any account adoption occurs. Organizations should immediately implement access control policies that restrict SCIM provisioning capabilities to trusted sources only, ensure proper token scoping and monitoring of provisioning activities, and conduct thorough security reviews of all SCIM integration points. Additionally, implementing automated alerting for unauthorized account modifications and regular security audits of provisioning mechanisms will help detect and prevent exploitation attempts. This vulnerability highlights the importance of validating authorization boundaries in identity management systems and aligns with ATT&CK technique T1078 which covers valid accounts as a means of gaining access to systems.
The vulnerability demonstrates a fundamental flaw in how the system handles account adoption during SCIM operations, where the absence of proper scope validation creates a direct path for privilege escalation. This type of security issue is particularly dangerous in identity and access management systems where improper access control can lead to complete system compromise. The fix requires implementing comprehensive authorization checks that validate not only the token's scope but also ensures that any account adoption operation respects the original scope boundaries established during token creation. Security teams should prioritize patching affected versions and implementing additional monitoring controls around SCIM provisioning activities to prevent unauthorized access attempts.