What is the CVSS score of CVE-2026-72534?

CVE-2026-72534 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of authentik are affected by CVE-2026-72534?

Authentik identity providers through version 2026.5.6 contain a critical privilege escalation in SCIM group provisioning that allows token holders to seize complete superuser control and permanently…

How to fix or mitigate CVE-2026-72534?

Within 24 hours: immediately audit all SCIM tokens and their scope; restrict SCIM provisioning to essential integrations only; enable comprehensive audit logging for SCIM group operations; and review administrator group membership for unauthorized changes. Within 7 days: complete a detailed audit of all SCIM-provisioned groups against authoritative sources to detect unauthorized modifications; implement network-level access controls restricting SCIM API access to known source IPs; and document emergency admin recovery procedures independent of Authentik. Within 30 days: obtain patch timeline from Authentik Security and evaluate alternative identity providers if no patch is available; prepare and test a complete rollback plan; and deploy continuous monitoring for unauthorized administrator provisioning attempts.

authentik CVE-2026-72534

EUVD-2026-56004 HIGH

Improper Privilege Management (CWE-269)

2026-08-11 TuranSec

GHSA-phh7-mppp-4jx8

Privilege Escalation Authentik

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L reflects mandatory possession of a SCIM provisioning token; S:U retained as impact is formally scoped to the authentik system boundary, with downstream IdP client compromise treated as an indirect consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:03 vuln.today

CVE Published

Aug 11, 2026 - 11:06 cve.org

HIGH 8.8

DescriptionCVE.org

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.

AnalysisAI

Privilege escalation in Authentik Security authentik through 2026.5.6 allows any holder of a source-scoped SCIM provisioning token to seize superuser control over the entire Identity Provider and permanently lock out all legitimate administrators. The root cause is the SCIM group ingest function's failure to validate whether the requesting token's source scope has authority over the target group - when an attacker provisions a SCIM group whose name matches an existing administrator group, authentik silently adopts and replaces that group's membership without authorization checks. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the high CVSS score of 8.8 and the total-takeover impact warrant immediate remediation.

Technical ContextAI

authentik is an open-source Identity Provider and Single Sign-On platform developed by Authentik Security, used in self-hosted enterprise environments for centralized authentication and authorization. The SCIM (System for Cross-domain Identity Management) provisioning protocol, enabled as an optional authentik source, allows external directories to push user and group objects into authentik via a REST API secured by per-source provisioning tokens. The vulnerability maps to CWE-269 (Improper Privilege Management) and resides specifically in the SCIM group ingest function, which matches incoming SCIM group payloads to existing internal groups by display name. Critically, this name-matching adoption operation does not enforce source scope - it does not verify whether the SCIM token's associated source is authorized to manage the target group. The CPE string cpe:2.3:a:authentik_security:authentik:*:*:*:*:*:*:*:* covering all versions through 2026.5.6 as confirmed by EUVD-2026-56004 indicates the flaw spans the entire documented release history up to that point.

RemediationAI

Upgrade authentik to a version above 2026.5.6 - no specific patched release version number was confirmed in the available reference data, so monitor the upstream repository at https://github.com/goauthentik/authentik for a tagged release that explicitly addresses CVE-2026-72534 or EUVD-2026-56004 before deploying. As an immediate compensating control pending a patch, disable all SCIM provisioning sources via the authentik administrator interface; this eliminates the vulnerable code path entirely but halts all automated user and group synchronization from external directories, requiring manual account lifecycle management during the mitigation window. If disabling SCIM is operationally infeasible, audit and revoke any SCIM provisioning tokens that are not actively required, reducing the pool of credentials that could be stolen or abused. Additionally, restrict network-level access to the authentik SCIM endpoint to only trusted provisioning host IP addresses using firewall rules or reverse-proxy access controls, raising the bar for an attacker who has obtained a token but lacks network adjacency. Renaming administrator groups to non-obvious display names provides minimal deterrence value only, as group names may remain discoverable via the SCIM API itself.