What is the CVSS score of EUVD-2026-56007?

EUVD-2026-56007 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of authentik are affected by EUVD-2026-56007?

Authentik identity management software through version 2026.5.6 contains a privilege escalation vulnerability allowing attackers with a SCIM provisioning token to take over any local account,…

How to fix or mitigate EUVD-2026-56007?

Within 24 hours: Immediately audit all SCIM provisioning tokens in your Authentik deployment and correlate with provisioning logs to identify any suspicious account creation or modification; establish real-time alerting on all account provisioning events. Within 7 days: Revoke and rotate all SCIM provisioning tokens in use; configure new tokens with minimal privileges scoped to essential integrations only. Within 30 days: Monitor vendor security advisories for patch availability for CVE-2026-72537 and prepare an expedited upgrade plan; implement network-level access controls to restrict which systems can reach Authentik SCIM provisioning endpoints.

authentik EUVD-2026-56007

| CVE-2026-72537 HIGH

Improper Privilege Management (CWE-269)

2026-08-11 TuranSec

GHSA-f25x-j567-ffxh

Privilege Escalation Authentik

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

SCIM token constitutes low-privilege credential; API is network-accessible; no user interaction needed; full account takeover yields high C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:05 vuln.today

CVE Published

Aug 11, 2026 - 11:07 cve.org

HIGH 8.8

DescriptionCVE.org

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.

AnalysisAI

Privilege escalation in Authentik Security authentik through version 2026.5.6 allows an attacker holding a source-scoped SCIM provisioning token to take over any local account, including superuser accounts, by provisioning a SCIM user whose username matches an existing account. The SCIM user ingest function adopts pre-existing local accounts by username without enforcing scope boundaries, meaning a limited-privilege provisioning credential can rewrite or delete accounts entirely outside its intended scope. No public exploit has been identified at time of analysis, but the attack requires only network access and a valid SCIM token, making the exploitation bar low for any attacker who has obtained such a credential.

Technical ContextAI

authentik (CPE: cpe:2.3:a:authentik_security:authentik:*:*:*:*:*:*:*:*) is an open-source Identity Provider supporting OAuth2, OIDC, SAML, and SCIM. SCIM (System for Cross-domain Identity Management, RFC 7644) is a REST-based protocol for automated cross-system user provisioning. In authentik, SCIM sources are assigned scoped provisioning tokens that are by design intended to restrict what accounts a given SCIM source can manage. The root cause, classified as CWE-269 (Improper Privilege Management), is in the SCIM user ingest function: when a SCIM source provisions a user whose username matches an existing local account, authentik adopts the pre-existing account rather than rejecting or creating a distinct record, without verifying whether the SCIM source token's scope authorizes modification of that account. This logic flaw means any scoped SCIM token - regardless of which source or subset of users it is meant to govern - can silently take ownership of and modify any account in the system, including the superuser with full administrative privileges over the identity provider and all downstream applications it protects.

RemediationAI

No specific patched release version is confirmed in the available intelligence - the EUVD listing identifies versions through 2026.5.6 as vulnerable, implying a fix may exist in a subsequent release, but no exact fix version has been independently verified from the provided data. Monitor the authentik GitHub repository (https://github.com/goauthentik/authentik) and official release notes closely for a patched version and upgrade as soon as one is available. As an immediate compensating control, disable or remove all SCIM provisioning sources in the authentik admin UI to eliminate the attack surface entirely; the trade-off is loss of automated user provisioning, which may require manual account management. If SCIM cannot be disabled, audit all issued SCIM tokens and revoke any held by third-party, externally-managed, or loosely trusted systems. Additionally, review authentik audit logs for anomalous SCIM provisioning events - particularly any instance where a SCIM source modified accounts not expected to be within its provisioning scope. Enforcing strict username namespace separation between SCIM-provisioned and locally-managed accounts can reduce collision risk but does not eliminate the underlying flaw.