What is the CVSS score of CVE-2026-94609?

CVE-2026-94609 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-94609?

Within 24 hours, inventory every authentik instance and record its exact version, then determine which instances grant delegated group, group-membership, or user management rights to accounts that are not full administrators, since only those deployments are exposed; where an affected instance is internet-facing or hosts delegated accounts, apply the vendor patch immediately or, if patching cannot be completed same-day, temporarily revoke the delegated permissions until the upgrade lands. Within 7 days, upgrade all remaining instances to the fixed releases: 2026.2.7 or later on the main line, 2026.5.7 or later on the 2026.5 line, and 2026.8.2 or later on the 2026.8 line, then audit each instance for groups whose ancestor groups confer superuser status, for role assignments made by accounts lacking the change_role permission, and for any superuser memberships that are not attributable to a known administrator - the flaw requires an authenticated delegated account to exploit, so unexplained privilege changes in the audit trail should be treated as potential compromise. Within 30 days, complete a least-privilege review of the delegation model, remove or tightly scope delegated management roles, add alerting on any grant of superuser status or role-permission changes in authentik, and confirm patch compliance across all instances and any disaster-recovery or staging clones that share the same configuration.

authentik CVE-2026-94609

Q: Which versions of authentik are affected by CVE-2026-94609?

A privilege-escalation flaw in the authentik identity provider lets an account that has been granted delegated group, membership, or user management rights promote itself to superuser, effectively…. A patch is available.

EUVD-2026-86279 HIGH

Improper Privilege Management (CWE-269)

2026-09-24 GitHub_M

Privilege Escalation Authentik Goauthentik

8.8

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as delegated group/user manager
Delivery

Target group inheriting superuser from ancestor
Exploit

Add self or assign role via API
Execution

Bypass missing authorization check
Impact

Obtain superuser over identity provider

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated account that has been delegated permission to manage a group, group membership, or a user (e.g. add_user_to_group / group or user management via the RBAC delegation documented in manage_groups). Exploitation is limited to deployments that delegate these management capabilities to accounts that are NOT full administrators - default single-administrator or non-delegated installations are unaffected. The escalation works either by leveraging superuser status inherited from an ancestor group (group hierarchy checks did not account for inherited superuser) or by assigning a role to a group with no change_role authorization check. No user interaction is needed beyond the attacker's own authenticated API calls.
Impact	This is a genuine, well-substantiated privilege-escalation flaw (CWE-269) confirmed and patched by the vendor via GHSA-h6c5-mpvq-j4jc, with source-level evidence in PRs #25956/#25961/#25966/#25971 that adds the missing authorization checks (ancestor-inherited superuser checks, enable_group_superuser and change_role gating). The NVD CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 High) is consistent with the description: a low-privileged but authenticated delegated administrator can escalate to superuser, which in an identity provider means total control of authentication for every downstream application. Signals partly conflict on breadth: there is no EPSS score, no CISA KEV listing, and no public exploit code provided, so exploitation is not confirmed in the wild - meaning this is a high-impact but not-yet-actively-exploited issue. Crucially, it is NOT exploitable against default deployments: it only affects installations that have delegated group/membership/user management to non-full-administrator accounts, which materially narrows the real-world attack surface below what the raw 8.8 suggests. Priority should therefore be high for organizations using authentik's RBAC delegation features and lower for single-admin deployments.
Exploit ScenarioDerived	An organization delegates day-to-day group or user management to a helpdesk/team-lead account that is not a full administrator. That account calls the groups or users API to add itself (or its group) to a group that inherits superuser status from an ancestor group, or assigns a privileged role to a group, without holding enable_group_superuser or change_role - gaining superuser over the entire identity provider. No public exploit code is provided, but the vendor's own regression tests demonstrate the exact API calls.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Privilege escalation in the authentik identity provider allows an account holding delegated group, group-membership, or user management rights to elevate itself to superuser by joining a group whose ancestor groups grant superuser status, or by assigning an existing role to a group without holding the change_role permission. Deployments running authentik before 2026.2.7, before 2026.5.7 on the 2026.5 line, or before 2026.8.2 on the 2026.8 line are affected, but exploitation is confined to installations that delegate those management capabilities to accounts that are not full administrators - single-administrator or non-delegated setups are unaffected. The flaw rates CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requires the attacker to hold an authenticated delegated account, and no public exploit code has been identified at time of analysis; vendor patches are available and the fix set is documented in advisory GHSA-h6c5-mpvq-j4jc.

RemediationAI

Vendor-released patch: upgrade to authentik 2026.2.7 for the 2026.2 line, 2026.5.7 for the 2026.5 line, or 2026.8.2 for the 2026.8 line; the fixes are described in the vendor advisory GHSA-h6c5-mpvq-j4jc and in the release notes at https://docs.goauthentik.io/releases/2026.2#fixed-in-202627, https://docs.goauthentik.io/releases/2026.5#fixed-in-202657, and https://docs.goauthentik.io/releases/2026.8#fixed-in-202682, with the underlying changes visible in PRs #25956, #25961, #25966, and #25971 and commits 5f95b86f6f70c3bd8c625a4f9ae474e235f84030, 67317f66f1b7eb16f2a26bf550dfd73699d49d87, 67e470dde8c81a40ee27ec6e178462368c561a60, and 898e4e4fa070642a3541a376af0de64fe3ffeb67. If patching is delayed, compensating controls are configuration-based and carry trade-offs: remove delegated roles that carry add_user_to_group, remove_user_from_group, group-edit, or user-edit permissions so non-administrator accounts cannot reach the vulnerable endpoints (this disables legitimate delegated helpdesk workflows), audit and where possible flatten the group hierarchy so no non-superuser group has an is_superuser ancestor that a delegated manager could join (flattening changes how inherited permissions propagate and must be validated against existing policies), and restrict role-assignment capability so only full administrators can attach roles to groups. Because exploitation requires only an authenticated delegated account and leaves little evidence beyond ordinary API calls carrying PR L-level privileges, review authentik audit logs for unexpected membership additions to superuser groups, new parent-group relationships, or role assignments performed by delegated accounts, and immediately remove any such memberships or roles.

Affected VersionsENISA

authentik 2026.8.0, < 2026.8.2

authentik < 2026.2.7

authentik 2026.5.0, < 2026.5.7

Affected Packages

euvd authentik fix: 2026.2.7, 2026.5.7, 2026.8.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

authentik is a Django/Django-REST-Framework-based open-source identity provider, and this issue is a CWE-269 improper privilege management defect rooted in inconsistent authorization checks across its Groups and Users REST APIs. The permission model centers on Group objects that can be flagged is_superuser, with membership in such a group (directly or via ancestor groups in the group hierarchy) conferring superuser status, plus Role objects from the authentik.rbac app that grant permission bundles. The serializer logic historically validated only the group's own is_superuser flag, so superuser status inherited from an ancestor group bypassed the enable_group_superuser check, and neither the group PATCH path nor the add_user membership endpoint re-validated ancestry before accepting new members or new parent groups. Separately, assigning an existing Role to a group lacked any change_role authorization gate. The upstream fix (visible in the PR diffs for #25956) rewrites validate_is_superuser, adds validate_parents and validate_roles, and expands the add_user view, all of which now build an ancestry queryset via with_ancestors() and require authentik_core.enable_group_superuser or authentik_rbac.change_role as appropriate; accompanying tests under test_groups_api_delegated_member_management.py codify the documented delegation permissions (view_group, add_user_to_group, remove_user_from_group, access_admin_interface, view_user). The affected code is identified by CPE cpe:2.3:a:goauthentik:authentik.

Know when Authentik gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Authenticated delegated manager (PR:L) makes network API calls with no user interaction; escalation to superuser of the IdP yields full confidentiality, integrity and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 24, 2026 - 17:03 EUVD

CVE Published

Sep 24, 2026 - 16:20 cve.org

HIGH 8.8

DescriptionCVE.org

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

Technical POC Analysis

Evidence supplied: the GitHub advisory text for GHSA-h6c5-mpvq-j4jc only.

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Executive ViewAI

Why It Matters

A privilege-escalation flaw in the authentik identity provider lets an account that has been granted delegated group, membership, or user management rights promote itself to superuser, effectively handing over control of the organization's central authentication and authorization platform. The exposure is limited to deployments that delegate those administrative capabilities to non-superuser accounts, so organizations using a single administrator or strictly non-delegated models are not exposed. Because authentik typically anchors SSO for the entire application estate, a single delegated-account takeover can cascade into broad access to downstream systems, making remediation a priority for any team using delegated administration.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.5%

Top 59% exploitable

Prevalence

Medium

popular open-source SSO/identity provider, common in self-hosted and enterprise SSO stacks

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.