{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/authentik/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:authentik:authentik:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-94609"},{"cvss":8.1,"id":"CVE-2026-40172"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["authentik (\u003c= 2026.2.6)","authentik (\u003c= 2026.5.6)","authentik (\u003c= 2026.8.1)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","authentik","rbac"],"_cs_type":"advisory","_cs_vendors":["authentik"],"content_html":"\u003cp\u003eauthentik is affected by a high-severity privilege escalation vulnerability (CVE-2026-94609) due to improper access control in the Groups API. The vulnerability exists within the \u003ccode\u003eGroupSerializer.validate_users()\u003c/code\u003e method, which fails to verify if the requesting user possesses the necessary \u003ccode\u003eauthentik_core.enable_group_superuser\u003c/code\u003e permission when modifying the membership of a group flagged with \u003ccode\u003eis_superuser=True\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eBy design, authentik uses two distinct permissions: \u003ccode\u003eauthentik_core.add_user_to_group\u003c/code\u003e for standard team roster management and \u003ccode\u003eauthentik_core.enable_group_superuser\u003c/code\u003e for assigning superuser status. Because the validation logic only checks for the presence of the routine management permission, an attacker holding a delegated \u0026quot;helpdesk\u0026quot; or \u0026quot;user manager\u0026quot; role can inject themselves or other users into existing superuser groups. This effectively bypasses the intended RBAC controls, leading to full instance compromise. This flaw is a symmetric counterpart to a previously fixed vulnerability (CVE-2026-40172). Affected versions include releases within the 2026.2, 2026.5, and 2026.8 branches.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains a low-privileged API token or session belonging to an account with \u003ccode\u003eauthentik_core.add_user_to_group\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the \u003ccode\u003e/api/v3/core/groups/\u003c/code\u003e endpoint to list available groups within the authentik instance.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target group that has the \u003ccode\u003eis_superuser=True\u003c/code\u003e attribute.\u003c/li\u003e\n\u003cli\u003eAttacker performs a \u003ccode\u003ePATCH\u003c/code\u003e request to \u003ccode\u003e/api/v3/core/groups/{group_uuid}/\u003c/code\u003e containing the target group UUID.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eGroupSerializer.validate_users()\u003c/code\u003e method processes the request, verifying only the routine \u003ccode\u003eadd_user_to_group\u003c/code\u003e permission.\u003c/li\u003e\n\u003cli\u003eThe system authorizes the injection of the attacker-controlled user ID into the superuser group's membership list.\u003c/li\u003e\n\u003cli\u003eThe target user is instantly granted full administrative superuser privileges within the authentik environment.\u003c/li\u003e\n\u003cli\u003eAttacker leverages full administrative access to manage SSO configurations, user accounts, and secret storage.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged user to gain full administrative control over the authentik instance. This facilitates unauthorized access to every tenant, interception of SSO authentication flows for downstream applications, modification of user accounts, and exfiltration or destruction of sensitive secrets and certificates managed by the instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate patching of all authentik instances to the fixed versions (2026.2.7, 2026.5.7, or 2026.8.2). If immediate patching is not possible, organizations must strictly audit and restrict the \u003ccode\u003eauthentik_core.add_user_to_group\u003c/code\u003e permission, ensuring it is revoked from all non-administrative roles. Detection teams should monitor for unauthorized \u003ccode\u003ePATCH\u003c/code\u003e requests targeting group membership, particularly where the initiator lacks administrative status.\u003c/p\u003e\n","date_modified":"2026-09-24T18:15:30Z","date_published":"2026-09-24T18:15:30Z","id":"https://feed.craftedsignal.io/briefs/2026-09-authentik-priv-esc/","summary":"An improper access control vulnerability (CVE-2026-94609) in authentik allows users with delegated group management permissions to elevate their privileges to full administrator by adding themselves to superuser-flagged groups.","title":"Privilege Escalation in authentik via Groups API","url":"https://feed.craftedsignal.io/briefs/2026-09-authentik-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Authentik","version":"https://jsonfeed.org/version/1.1"}