authentik CVE-2026-40172

The attacker must possess a valid authentik session with the change_user permission on the target user (or equivalent group-modification permission), matching CVSS PR:L - this is exactly the delegated user-administration role that authentik documents as safe to grant to help-desk staff, so the realistic precondition is 'any tenant that has delegated user management to non-superusers'. A superuser group with is_superuser=True must already exist in the deployment (the default authentik installation ships such a group), and the /api/v3/core/users/{pk}/ endpoint must be network-reachable from the attacker. Limiting factors: deployments that have not delegated change_user or group-edit permissions outside the existing administrator pool gain no new attack surface from this bug, and pre-release-only deployments on the 2026.2 line before rc1 are not affected.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H aligns with the description: the attack is network-reachable, requires only low (delegated) privileges, needs no user interaction, and produces high integrity and availability impact while confidentiality impact is rated none (the act of granting a group does not by itself read data, although the resulting superuser session obviously can). The 8.1 base score is credible for an identity provider because compromise of the IdP cascades into every federated application. No EPSS, KEV, or POC signal is present in the supplied data, so this is currently a high-severity but not-yet-actively-exploited issue; however, the simplicity of the exploit (one authenticated PATCH call) means EPSS is likely to rise quickly once the advisory propagates. Defenders who have delegated any user-management permission to non-administrators should treat this as a real priority rather than a theoretical CVSS-inflation case.

A help-desk operator (or any attacker who has compromised a help-desk account) who has been granted the change_user permission sends a single authenticated PATCH /api/v3/core/users/{pk}/ request with a JSON body that adds the built-in superuser group to their own user record or to a controlled service account. On the next session refresh the targeted account inherits is_superuser=True, granting full control of authentik and, through federation, every downstream application that trusts it. No public exploit code is identified at time of analysis, but the exploit reduces to one HTTP request and could be reproduced from the advisory text alone.