CVE-2026-94609

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

• CWE-269
• CWE-863

• https://docs.goauthentik.io/releases/2026.2#fixed-in-202627
• https://docs.goauthentik.io/releases/2026.5#fixed-in-202657
• https://docs.goauthentik.io/releases/2026.8#fixed-in-202682
• https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030
• https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87
• https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60
• https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67
• https://github.com/goauthentik/authentik/pull/25956
• https://github.com/goauthentik/authentik/pull/25961
• https://github.com/goauthentik/authentik/pull/25966
• https://github.com/goauthentik/authentik/pull/25971
• https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7
• https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7
• https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2
• https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc

Published

Sep 24, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9458A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-94588In Proxmox pmg-api, an argument injection vulnerability exis…4.4
• CVE-2026-9459A security flaw has been discovered in Edimax EW-7438RPn 1.3…8.8
• CVE-2026-9460A weakness has been identified in Edimax EW-7438RPn 1.31. Th…8.8
• CVE-2026-94604Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-94606authentik is an open-source identity provider. Prior to 2026…8.9
• CVE-2026-9461A security vulnerability has been detected in Edimax EW-7438…8.8
• CVE-2026-94611authentik is an open-source identity provider. Prior to 2026…8.1
• CVE-2026-94612authentik is an open-source identity provider. Prior to 2026…7.4
• CVE-2026-94613authentik is an open-source identity provider. Prior to 2026…7.5
• CVE-2026-9462A vulnerability was detected in Edimax EW-7438RPn 1.31. Affe…8.8
• CVE-2026-94622vLLM versions through 0.29.0 contain a denial of service vul…7.5