CVE-2026-40172: authentik Privilege Escalation Vulnerability

CVE-2026-40172 Overview

CVE-2026-40172 is a privilege escalation vulnerability in authentik, an open-source identity provider. The flaw resides in the PATCH /api/v3/core/users/{pk}/ endpoint, which allows a caller holding the change_user permission to assign arbitrary groups through UserSerializer. Affected callers can attach groups marked is_superuser=True without the enable_group_superuser safeguard required by group-management paths. This bypass enables delegated user-management operators to elevate themselves or other users to administrator-equivalent privilege [CWE-269]. The issue affects versions prior to 2025.12.5 and the 2026.2.0-rc1 through 2026.2.2 release line.

Critical Impact
An authenticated user with change_user rights can promote any account to superuser, fully compromising the identity provider and any downstream applications it federates.

Affected Products

authentik versions prior to 2025.12.5
authentik 2026.2.0-rc1 through 2026.2.2
Deployments granting delegated change_user or group-update permissions to non-admin operators

Discovery Timeline

2026-05-22 - CVE-2026-40172 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-40172

Vulnerability Analysis

The vulnerability stems from an inconsistent permission model between authentik's user-update and group-update code paths. The UserSerializer used by PATCH /api/v3/core/users/{pk}/ accepts a groups field and writes the supplied group references directly to the target user. Group-management endpoints enforce an additional check, enable_group_superuser, before allowing a group with is_superuser=True to be linked to a user. The user PATCH path omits that check.

An authenticated caller who holds change_user on any target account can therefore attach a privileged group through the user endpoint and bypass the stricter group-side gating. The result is a complete privilege escalation: a delegated helpdesk or user-management role becomes equivalent to global administrator. Because authentik commonly federates downstream SaaS and internal applications, escalation inside authentik translates to administrative reach across every connected service.

Root Cause

The root cause is improper privilege management [CWE-269]. The serializer trusts the groups payload field and applies it without validating that the caller is authorized to grant the superuser attribute carried transitively by those groups. Two enforcement points exist for the same security-relevant action, and only one of them performs the superuser gating.

Attack Vector

Exploitation requires an authenticated session with change_user on a target user, or permissions to modify groups containing target users. The attacker issues a PATCH request to /api/v3/core/users/{pk}/ and includes a groups array referencing a group whose is_superuser flag is True. The serializer persists the assignment, and the next authentication by the target user yields superuser context. The attacker can target their own account or any account they hold change_user over. No user interaction is required, and the attack is delivered over the network through normal API traffic.

Verified exploit code is not published for this issue. See the GitHub Security Advisory GHSA-h6x7-hjjc-wjc9 for vendor-supplied technical details.

Detection Methods for CVE-2026-40172

Indicators of Compromise

PATCH requests to /api/v3/core/users/{pk}/ whose JSON body contains a groups field, originating from non-administrator sessions.
New membership entries linking standard users to groups carrying is_superuser=True, particularly when added by a non-admin actor.
Authentication events showing newly granted superuser context for accounts that previously held only standard roles.

Detection Strategies

Audit the authentik events log for model_updated entries on the User model where groups changed and the actor lacks the administrator role.
Correlate user PATCH API calls with subsequent group membership deltas in the authentik database to surface escalation chains.
Alert on any change to membership of groups whose is_superuser attribute is True, regardless of which endpoint performed the change.

Monitoring Recommendations

Forward authentik API access logs and event logs to a centralized analytics platform and retain them for forensic review.
Baseline the set of accounts authorized to call /api/v3/core/users/ with write methods and alert on deviations.
Periodically enumerate all members of superuser-flagged groups and reconcile against an approved administrator list.

How to Mitigate CVE-2026-40172

Immediate Actions Required

Upgrade authentik to version 2025.12.5 or 2026.2.3 without delay.
Review every group with is_superuser=True and remove any members added since the vulnerable releases were deployed.
Revoke change_user and group-update permissions from any role that does not strictly require them until patching is complete.
Rotate API tokens and session credentials for accounts that may have been escalated.

Patch Information

The vendor fixed the issue in authentik 2025.12.5 and 2026.2.3. The patched releases apply the enable_group_superuser gating to the user PATCH path so that superuser-carrying groups cannot be assigned through UserSerializer without the elevated permission. See the GitHub Security Advisory GHSA-h6x7-hjjc-wjc9 for full release notes.

Workarounds

Restrict the change_user permission to administrator-equivalent roles until the upgrade is applied.
Remove the is_superuser flag from any group not explicitly required for platform administration, reducing the blast radius of an escalation attempt.
Place authentik admin and API endpoints behind network-level access controls so that only trusted operators can reach /api/v3/core/users/.

bash

# Verify the running authentik version meets the fixed release
docker exec authentik-server ak version
# Expected output: 2025.12.5 or 2026.2.3 (or later)