CVE-2026-72534: Authentik Security Privilege Escalation

CVE-2026-72534 Overview

CVE-2026-72534 is a privilege escalation vulnerability [CWE-269] in Authentik Security's authentik identity provider through version 2026.5.6. The flaw resides in the System for Cross-domain Identity Management (SCIM) group ingest function. An attacker holding a source-scoped SCIM provisioning token can provision a group whose name matches an existing administrator group. The ingest logic adopts the existing group and replaces its membership without validating the source scope against the target group. This allows an authenticated attacker to grant their provisioning token full IdP superuser access and lock out legitimate administrators.

Critical Impact
An attacker with a low-privilege SCIM token can gain superuser control of the authentik identity provider and revoke access for all existing administrators.

Affected Products

Authentik Security authentik through version 2026.5.6
Deployments exposing SCIM provisioning endpoints
Any authentik instance using source-scoped SCIM tokens for group provisioning

Discovery Timeline

2026-08-11 - CVE-2026-72534 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72534

Vulnerability Analysis

The vulnerability exists in authentik's SCIM group ingestion pathway. SCIM is a standard protocol for automating identity data exchange between systems. When authentik receives a SCIM group creation request, the ingest function looks up any existing group with a matching display name. If a match is found, the function adopts the existing group record and replaces its membership list with the members supplied in the provisioning request.

The attack succeeds because the ingest function performs no authorization check comparing the SCIM token's source scope to the scope of the group it is about to modify. Any group in the directory becomes a valid adoption target, including built-in administrator groups that grant superuser rights.

Root Cause

The root cause is missing scope validation between the caller and the target object. The SCIM provisioning token is bound to a specific source, but the group adoption logic treats display name uniqueness as sufficient authorization. This is a broken access control pattern that maps to [CWE-269: Improper Privilege Management].

Attack Vector

An attacker requires a valid source-scoped SCIM provisioning token. The attacker sends a SCIM group creation request with a displayName matching an existing administrator group, for example authentik Admins. The request includes the attacker's own service principal as a member. The ingest function overwrites the administrator group membership, granting the attacker superuser privileges and removing all existing administrators from the group.

Refer to the Authentik GitHub repository for advisory details and patch commits.

Detection Methods for CVE-2026-72534

Indicators of Compromise

Unexpected SCIM group creation or update requests targeting groups with administrator-related display names such as authentik Admins, Superusers, or admins.
Sudden changes to membership of privileged groups where the modifying principal is a SCIM provisioning token rather than a human administrator.
Existing administrators reporting loss of access to the authentik management console.

Detection Strategies

Audit authentik event logs for model_updated and group_membership_changed events sourced from SCIM providers.
Correlate SCIM API activity against a baseline of expected provisioning source scopes and group targets.
Alert on any SCIM-driven modification of groups that carry the is_superuser attribute or map to administrative roles.

Monitoring Recommendations

Forward authentik audit logs to a centralized SIEM and build detections for SCIM writes to privileged groups.
Monitor for administrator lockout events, including failed logins from previously active admin accounts immediately after SCIM traffic.
Track token issuance and usage patterns for SCIM provisioning tokens, flagging tokens that suddenly modify high-value groups.

How to Mitigate CVE-2026-72534

Immediate Actions Required

Upgrade authentik to a version released after 2026.5.6 that contains the fix for CVE-2026-72534.
Rotate all SCIM provisioning tokens issued before the upgrade and audit their historical activity.
Review membership of all administrator and superuser groups and remove any unauthorized principals introduced through SCIM.

Patch Information

Authentik Security addresses the flaw in versions after 2026.5.6. Consult the Authentik GitHub repository for the specific release notes and security advisory covering CVE-2026-72534, then apply the corresponding container image or package update.

Workarounds

Disable SCIM inbound provisioning sources until the patch can be applied.
Restrict SCIM provisioning tokens to sources that cannot resolve to privileged group names, and rename administrative groups to values not reachable by external provisioning systems.
Enforce network-level access controls on SCIM endpoints so only trusted identity systems can call them.

bash

# Configuration example: temporarily disable SCIM inbound sources via API
curl -X PATCH "https://authentik.example.com/api/v3/sources/scim/<source-uuid>/" \
  -H "Authorization: Bearer <admin-api-token>" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'