Privilege Escalation Vulnerability in Authentik Identity Provider

CVE-2026-94609

What is CVE-2026-94609?

Prior to the versions 2026.2.7, 2026.5.7, and 2026.8.2, Authentik had a privilege escalation vulnerability whereby accounts with delegated group management permissions could grant superuser status without proper authorization. This issue affected only deployments where non-administrators were given management capabilities. Flaws in group hierarchy checks allowed these accounts to bypass necessary restrictions that should have governed their permissions, leading to potential unauthorized access to sensitive functionalities.

References