CVE-2026-94609
highauthentik is an open-source identity provider.
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://docs.goauthentik.io/releases/2026.2#fixed-in-202627 security-advisories@github.com
- https://docs.goauthentik.io/releases/2026.5#fixed-in-202657 security-advisories@github.com
- https://docs.goauthentik.io/releases/2026.8#fixed-in-202682 security-advisories@github.com
- https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030 security-advisories@github.com
- https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87 security-advisories@github.com
- https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60 security-advisories@github.com
- https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67 security-advisories@github.com
- https://github.com/goauthentik/authentik/pull/25956 security-advisories@github.com
- https://github.com/goauthentik/authentik/pull/25961 security-advisories@github.com
- https://github.com/goauthentik/authentik/pull/25966 security-advisories@github.com
- https://github.com/goauthentik/authentik/pull/25971 security-advisories@github.com
- https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7 security-advisories@github.com
- https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7 security-advisories@github.com
- https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2 security-advisories@github.com
- https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc security-advisories@github.com