CVE-2026-72537

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.5.7

Description A privilege escalation issue exists where an attacker possessing a source-scoped SCIM provisioning token can take over any user account, including superusers. This occurs because the SCIM user ingest function adopts pre-existing local accounts based on the username without validating scope boundaries. Consequently, an attacker can rewrite or delete any account using a limited provisioning credential.

Recommendations Update to version 2026.5.7 or later.