CVE-2026-72537

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/goauthentik/authentik

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de escalada de privilegios en Authentik Security authentik hasta 2026.5.6 permite a un atacante con un token de aprovisionamiento SCIM con ámbito de origen tomar el control de cualquier cuenta de usuario, incluyendo superusuarios, mediante el aprovisionamiento de un usuario SCIM que coincide con un usuario local existente por nombre de usuario. La función de ingesta de usuarios SCIM adopta cuentas locales preexistentes por nombre de usuario sin validar los límites de ámbito. Un atacante puede reescribir o eliminar cualquier cuenta, incluyendo el superusuario, utilizando solo una credencial de aprovisionamiento limitada.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72537

Mitre link : CVE-2026-72537

CVE.ORG link : CVE-2026-72537

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2026-72537", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72537", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T12:38:53.759720Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Authentik Security", "product": "authentik", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.5.6"}]}]}], "published": "2026-08-11T12:17:38.977", "references": [{"url": "https://github.com/goauthentik/authentik", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios en Authentik Security authentik hasta 2026.5.6 permite a un atacante con un token de aprovisionamiento SCIM con \u00e1mbito de origen tomar el control de cualquier cuenta de usuario, incluyendo superusuarios, mediante el aprovisionamiento de un usuario SCIM que coincide con un usuario local existente por nombre de usuario. La funci\u00f3n de ingesta de usuarios SCIM adopta cuentas locales preexistentes por nombre de usuario sin validar los l\u00edmites de \u00e1mbito. Un atacante puede reescribir o eliminar cualquier cuenta, incluyendo el superusuario, utilizando solo una credencial de aprovisionamiento limitada."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}