Privilege Escalation Vulnerability in Authentik Security Product

CVE-2026-72534

What is CVE-2026-72534?

A vulnerability in Authentik Security's product permits privilege escalation due to improper validation of SCIM group provisionings. Specifically, this flaw allows an attacker to use a source-scoped SCIM provisioning token to gain superuser privileges by creating a SCIM group that matches an existing administrator group's name. The system incorrectly accepts the name match, allowing the attacker to replace the original group's membership. As a result, this could give the attacker comprehensive IdP superuser access, potentially excluding all legitimate administrators from access.

References