Open-source Identity Provider Privilege Escalation Vulnerability in Authentik

CVE-2026-40172

What is CVE-2026-40172?

Authentik, an open-source identity provider, has a vulnerability in its API that allows users with specific permissions to escalate their privileges unlawfully. In affected versions, users who can change user permissions can also assign themselves and others to groups that possess administrative capabilities without proper validation checks. This flaw bypasses the stricter controls of the group management system, exposing the application to potential abuses of privilege, particularly in user management operations. The issue has been addressed in later releases.

References