Is CVE-2026-72537 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72537 being exploited in the wild.

How severe is CVE-2026-72537?

High severity, with a CVSS score of 8.8, published 11 August 2026.

Which products and versions are affected?

Authentik Security authentik through 2026.5.6.

Is there a fix for CVE-2026-72537?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-72537 attacked?

It is attacked over the network.

Am I affected by CVE-2026-72537?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72537: Authentik privilege escalation in SCIM provisioning

CVE-2026-72537 · Severity: high · CVSS 8.8 · Published 2026-08-11

Authentik is an open-source authentication and authorization platform used to manage user access and identity. A flaw in its SCIM provisioning system allows an attacker with limited provisioning credentials to take over any user account, including administrator accounts, by creating matching SCIM users. This could result in complete compromise of the authentication system and unauthorized access to protected applications.

Quick answers

Is CVE-2026-72537 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72537 being exploited in the wild.
How severe is CVE-2026-72537?: High severity, with a CVSS score of 8.8, published 11 August 2026.
Which products and versions are affected?: Authentik Security authentik through 2026.5.6.
Is there a fix for CVE-2026-72537?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-72537 attacked?: It is attacked over the network.
Am I affected by CVE-2026-72537?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw in Authentik's SCIM user provisioning function that fails to enforce scope boundaries when adopting pre-existing local accounts. An attacker with a source-scoped SCIM provisioning token can provision a SCIM user that matches an existing local username, causing the system to adopt the local account without validating that the provisioning token has authority over that account. This allows the attacker to rewrite or delete any account, including superuser accounts, using only limited provisioning credentials. The vulnerability affects Authentik through version 2026.5.6; patches or fixes should be available in later releases.

Affected products

Authentik Security authentik through 2026.5.6

Timeline

2026-08-11: disclosed

References

https://github.com/goauthentik/authentik

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.