Quick answers
- Is CVE-2026-72534 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72534 being exploited in the wild.
- How severe is CVE-2026-72534?
- High severity, with a CVSS score of 8.8, published 11 August 2026.
- Which products and versions are affected?
- Authentik Security authentik through 2026.5.6.
- Is there a fix for CVE-2026-72534?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-72534 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-72534?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a privilege escalation in Authentik's SCIM group provisioning function. The root cause is improper validation of source scope constraints when ingesting SCIM groups; the system adopts existing groups by name and replaces membership without verifying that the provisioning token's scope permits access to that group. An attacker with a source-scoped SCIM provisioning token can send a malicious SCIM request creating a group matching an existing administrator group name, which causes the system to merge the attacker-controlled membership into the privileged group. No special preconditions beyond token possession are required. The attacker gains full IdP superuser access and can lock out all existing administrators. A patch is available in versions after 2026.5.6.
Affected products
- Authentik Security authentik through 2026.5.6
Timeline
- 2026-08-11: disclosed