BIT-authentik-2026-94609

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/authentik/BIT-authentik-2026-94609.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-authentik-2026-94609
Aliases
Published
2026-10-01T09:23:06Z
Modified
2026-10-01T10:10:53Z
Summary
authentik: Privilege Escalation to Superuser via Group Hierarchy
Details

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / authentik

Package

Name
authentik
Purl
pkg:bitnami/authentik

Severity

  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.2.7
Introduced
2026.5.0
Fixed
2026.5.7
Introduced
2026.8.0
Fixed
2026.8.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/authentik/BIT-authentik-2026-94609.json"