BIT-authentik-2026-25227

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/authentik/BIT-authentik-2026-25227.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-authentik-2026-25227
Aliases
Published
2026-04-16T23:36:32.477Z
Modified
2026-04-17T04:57:17.365614637Z
Summary
authentik affected by Remote Code Execution via Context Key Injection in PropertyMapping Test Endpoint
Details

authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / authentik

Package

Name
authentik
Purl
pkg:bitnami/authentik

Severity

  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
2021.3.1
Fixed
2025.8.6
Introduced
2025.10.0
Fixed
2025.12.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/authentik/BIT-authentik-2026-25227.json"