Privilege Escalation Vulnerability in Authentik Identity Provider
CVE-2026-94609
Key Information:
- Vendor
Goauthentik
- Status
- Vendor
- CVE Published:
- 24 September 2026
Badges
What is CVE-2026-94609?
Prior to the versions 2026.2.7, 2026.5.7, and 2026.8.2, Authentik had a privilege escalation vulnerability whereby accounts with delegated group management permissions could grant superuser status without proper authorization. This issue affected only deployments where non-administrators were given management capabilities. Flaws in group hierarchy checks allowed these accounts to bypass necessary restrictions that should have governed their permissions, leading to potential unauthorized access to sensitive functionalities.
Affected Version(s)
authentik < 2026.2.7 < 2026.2.7
authentik >= 2026.5.0, < 2026.5.7 < 2026.5.0, 2026.5.7
authentik >= 2026.8.0, < 2026.8.2 < 2026.8.0, 2026.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.