CVE-2026-40172

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40172
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40172.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40172
Aliases
Published
2026-05-22T19:00:52Z
Modified
2026-08-12T03:51:11Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser
Details

authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/{pk}/ API allows a caller with change_user on a target user to assign arbitrary groups through UserSerializer, including groups with is_superuser=True, without requiring enable_group_superuser, leading to privilege escalation. This bypasses the stricter permission model enforced in group-management paths and enables delegated user-management permissions to escalate target users to administrator-equivalent privilege. Users with permissions to update groups or permissions to update users are able to add themselves or other users they have permissions on to users which have superuser permissions. This issue has been fixed in versions 22025.12.5 and 2026.2.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40172.json"
}
References

Affected packages

Git / github.com/goauthentik/authentik

Affected ranges

Type
GIT
Repo
https://github.com/goauthentik/authentik
Events
Introduced
3394c17bfd5e208f8e8d53e450158e486afe575b
Fixed
5249546862986202b901c2afd860992ec48c6ef6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2026.2.0-rc1"
        },
        {
            "fixed": "2026.2.2"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

version/2026.*
version/2026.2.0
version/2026.2.0-rc1
version/2026.2.0-rc2
version/2026.2.0-rc3
version/2026.2.0-rc4
version/2026.2.0-rc5
version/2026.2.1
version/2026.2.1-rc1
version/2026.2.2-rc1
version/2026.2.2-rc2
version/2026.2.2-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40172.json"