CVE-2026-94609

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.7 authentik versions prior to 2026.5.7 authentik versions prior to 2026.8.2

Description An account with delegated permissions to manage a user, group, or group membership can grant superuser status to an account or assign an existing role to a group without possessing the necessary permissions. This occurs because group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. This issue only affects deployments that delegate these management capabilities to accounts that are not full administrators.

Recommendations Update to version 2026.2.7. Update to version 2026.5.7. Update to version 2026.8.2.