authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
goauthentik authentik affected
Version Status Constraints
< 2026.2.7 affected —
>= 2026.5.0, < 2026.5.7 affected —
>= 2026.8.0, < 2026.8.2 affected —

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://docs.goauthentik.io/releases/2026.2#fixed-in-202627 cve-icon
https://docs.goauthentik.io/releases/2026.5#fixed-in-202657 cve-icon
https://docs.goauthentik.io/releases/2026.8#fixed-in-202682 cve-icon
https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030 cve-icon
https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87 cve-icon
https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60 cve-icon
https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67 cve-icon
https://github.com/goauthentik/authentik/pull/25956 cve-icon
https://github.com/goauthentik/authentik/pull/25961 cve-icon
https://github.com/goauthentik/authentik/pull/25966 cve-icon
https://github.com/goauthentik/authentik/pull/25971 cve-icon
https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7 cve-icon
https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7 cve-icon
https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2 cve-icon
https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc cve-icon
History

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
Title authentik: Privilege Escalation to Superuser via Group Hierarchy
Weaknesses CWE-269
CWE-863
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-24T16:20:45.703Z

Reserved: 2026-09-21T21:32:23.741Z

Link: CVE-2026-94609

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses