CVE-2026-72537: Authentik Privilege Escalation Vulnerability

CVE-2026-72537 Overview

CVE-2026-72537 is a privilege escalation vulnerability in Authentik Security's authentik identity provider through version 2026.5.6. An attacker holding a source-scoped System for Cross-domain Identity Management (SCIM) provisioning token can take over any local account, including superusers, by provisioning a SCIM user whose username matches an existing local user. The SCIM user ingest function adopts pre-existing accounts by username without validating scope boundaries. A limited provisioning credential becomes sufficient to rewrite or delete any account in the directory. The flaw is tracked under CWE-269: Improper Privilege Management.

Critical Impact
A source-scoped SCIM token can be leveraged to hijack or delete any authentik account, including superuser accounts, leading to full identity provider compromise.

Affected Products

Authentik Security authentik through version 2026.5.6
Deployments using SCIM provisioning sources
Any tenant issuing source-scoped SCIM tokens to third parties

Discovery Timeline

2026-08-11 - CVE-2026-72537 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72537

Vulnerability Analysis

Authentik exposes SCIM as an inbound provisioning surface for external identity systems. When a SCIM client creates a user, the ingest logic looks up existing local accounts by username to reconcile duplicates. The lookup ignores the scope attached to the calling provisioning token. As a result, a token issued for a narrow source can match and adopt accounts owned by other sources or created locally by administrators. Once adopted, the SCIM caller can overwrite attributes on the record, effectively rewriting the identity, or issue a delete to remove the account. Because superusers are stored in the same user table, they are equally reachable by this reconciliation path.

Root Cause

The root cause is missing authorization enforcement in the SCIM user ingest function. The reconciliation step matches on the username field and adopts any pre-existing record without checking whether the caller's token scope covers that record. The design assumes SCIM callers own the namespace they write into, but the code does not enforce that boundary. This is a classic CWE-269 failure where a lower-privilege credential is allowed to act on higher-privilege objects.

Attack Vector

An attacker needs a valid source-scoped SCIM provisioning token, which may be obtained through partner integrations, compromised third-party systems, or misconfigured source assignments. The attacker sends a SCIM POST /Users request with a userName value matching a target account, such as an administrator or superuser. Authentik locates the existing account, adopts it under the attacker's source, and applies the submitted attributes. The attacker can then change email, associated groups, or credential bindings tied to that account, or issue a SCIM DELETE to remove it. Refer to the GitHub Authentik Repository for implementation details.

Detection Methods for CVE-2026-72537

Indicators of Compromise

SCIM POST /Users or PUT /Users requests where userName matches an existing administrator or superuser account.
Unexpected changes in account ownership, where a previously local or differently-sourced account becomes associated with a SCIM source.
SCIM DELETE /Users/{id} operations targeting privileged accounts.
Audit log entries showing user attribute rewrites originating from a source-scoped provisioning token.

Detection Strategies

Baseline the set of usernames each SCIM source is authorized to manage and alert on ingest events that fall outside that baseline.
Correlate authentik audit logs for model_updated and model_deleted events on user objects with the originating SCIM token identifier.
Flag any SCIM-driven mutation targeting accounts with the is_superuser flag or administrative group membership.

Monitoring Recommendations

Forward authentik event logs to a centralized analytics platform and retain them for privileged-account change review.
Alert on first-time association between a SCIM source and any account holding elevated privileges.
Monitor SCIM API traffic volume per token and investigate spikes involving privileged usernames.

How to Mitigate CVE-2026-72537

Immediate Actions Required

Upgrade authentik to a version later than 2026.5.6 that contains the fix for CVE-2026-72537.
Rotate all SCIM provisioning tokens and audit which external systems currently hold them.
Review recent SCIM ingest activity for adoption or deletion events targeting administrator and superuser accounts.
Restore or re-provision any account whose attributes were altered by an unauthorized SCIM operation.

Patch Information

Refer to the GitHub Authentik Repository for the fixed release and associated security advisory. Deployments running any version through 2026.5.6 should apply the vendor update before re-enabling SCIM provisioning sources.

Workarounds

Temporarily disable SCIM provisioning sources until the patched version is deployed.
Restrict SCIM token issuance to trusted internal systems and revoke tokens held by external partners.
Enforce network-level restrictions so that SCIM endpoints accept requests only from allow-listed source IP ranges.
Reserve administrator and superuser usernames using naming conventions that will not appear in any external SCIM directory.

bash

# Configuration example: disable a SCIM source via the authentik API
curl -X PATCH "https://authentik.example.com/api/v3/sources/scim/<source-slug>/" \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'