CVE-2026-72534

Executive Summary

CVE-2026-72534 is a privilege escalation vulnerability in Authentik Security authentik versions through 2026.5.6. An attacker holding a source-scoped SCIM provisioning token can escalate to superuser (IdP administrator) privileges by provisioning a SCIM group whose name matches an existing administrator group; the SCIM ingest function adopts the existing group by name and replaces its membership without cross-checking that the provisioning source's scope is permitted to modify that group. This is a critical flaw (CVSS 8.8) requiring low-privilege access (SCIM token holder) with no user interaction, and it can lead to full takeover of the identity provider — including the ability to lock out all existing administrators. As of this report, no vendor patch, workaround, or public exploit has been identified, leaving deployments running version 2026.5.6 or earlier at risk of active exploitation.

Technical Analysis

The vulnerability resides in the SCIM (System for Cross-domain Identity Management) group provisioning functionality of authentik. Based strictly on the NVD description, the flaw mechanism can be broken down as follows:

1. SCIM token scope segregation failure: Authentik issues SCIM provisioning tokens that are expected to be scoped to a specific source (e.g., a single connected identity provider or tenant). The design intent is that a token can only modify groups and users within its own source scope. The vulnerability demonstrates that this scope boundary is not enforced during the group ingest (adoption) path.

2. Group adoption by name without authorization check: The SCIM group ingest function, when receiving a Group object (as defined by the SCIM 2.0 protocol), searches the authentik backend for an existing group by name. If a match is found, the function adopts that group — meaning it takes ownership and replaces the membership list with the members provided in the SCIM provisioning payload. Critically, it does NOT validate that the SCIM source scope (associated with the provisioning token) matches the scope/authorization domain of the target group.

3. Privilege escalation via administrator group name collision: Because administrator groups (e.g., those holding authentik_admin or authentik_superuser roles) exist as regular group objects in the backend, an attacker who knows the names of these groups (often default or enumerable via other SCIM queries) can provision a SCIM group with the SAME name. The ingest function adopts the real administrator group and replaces its membership with attacker-controlled members. This grants the attacker's chosen user(s) direct membership in the admin group, thereby escalating to superuser privileges in the authentik IdP.

4. Lateral impact — lockout vector: The NVD description explicitly notes that the attacker can "lock out all existing administrators." This is a logical consequence of the membership replacement: since the ingest function fully replaces the membership list rather than performing an additive merge, provisioning an empty group or a group containing only attacker users will strip the original administrator members from the group, denying them access to the admin console.

Attack surface: The vulnerability is reachable via the network (CVSS AV:N) and requires only Low privilege (PR:L) — that is, possession of any valid source-scoped SCIM provisioning token (e.g., a token for an external HR system, SaaS provisioning connector, or secondary tenant). No user interaction is required (UI:N). The attack does not require anything exotic: no physical access, no race condition, no out-of-process state — it is a pure logic/authorization flaw in the group adopt-and-replace code path.

CWE classification: This falls under CWE-269 — Improper Privilege Management, because the software fails to enforce that the SCIM source principal (the provisioning token) holds the necessary privilege/authorization to modify the target group's membership. The flaw is sibling to IDOR (CWE-639) but is best described as a missing source_scope check against the target_group.scope during group adoption.

Technical detail gap: The NVD description does not provide specific function names, code snippets, or endpoint paths (e.g., no /api/v3/scim/groups/ endpoint is named). It is therefore not possible to provide a code-level trace beyond the described behavior. We treat the described steps ("provisioning a SCIM group", "group ingest function adopts existing group by name", "replaces its membership") as the authoritative mechanism. No other implementation details are available in the provided data.

Exploitation Scenarios

Attack chain constructed strictly from the NVD description. No public PoC is available; the steps below describe the likely attack sequence at the vulnerability-class level.

Scenario 1 — Direct admin group takeover (default path)

1. Reconnaissance: The attacker, having obtained (or been issued) a source-scoped SCIM provisioning token, first enumerates the target authentik instance to identify existing group names. This can be done by querying SCIM /Groups endpoints (standard SCIM 2.0 resource discovery) or by common admin group naming conventions (e.g., admin, administrators, authentik_superuser). The NVD description confirms that the flaw is triggered specifically when the attacker "provisions a SCIM group that matches an existing administrator group by name" — so name discovery is the prerequisite.

2. Triggering the flaw: Using the SCIM token, the attacker issues a POST /Groups (or PUT) request with a displayName equal to the target admin group's name and a members array containing the attacker's controlled user ID(s) (or an empty array to trigger lockout). The SCIM ingest handler matches the existing admin group by name, adopts it, and replaces its membership — without checking whether the token's source scope authorizes modification of that group.

3. Payload/execution: The payload is a standard SCIM 2.0 group resource. No exotic encoding or injection is required — the vulnerability is in the handling logic, not request parsing. The attacker controls the members attribute to select which principals become members of the admin group.

4. Post-exploitation: Post-adoption, the attacker (or their controlled user) is now a member of the admin group and gains full IdP superuser privileges — able to modify authentication policies, realm mappings, secrets, and downstream application trust. In the lockout variant, they provision an empty member list, stripping all pre-existing admins and denying them console access, while the attacker's account retains access.

Scenario 2 — Lockout only (availability attack)

1. Reconnaissance: Same group name enumeration.
2. Trigger: Provision SCIM group with the target admin group name and an empty members array (or members list that does not include the current admins).
3. Post-exploitation impact: All legitimate superusers are removed from the admin group, locking them out of the authentik admin console. If the attacker does not add their own user, this constitutes a denial-of-service on the identity provider; if combined with scenario 1, the attacker retains full control.

Scenario 3 — Multi-tenant pivot

1. Reconnaissance: The attacker is an admin of a lower-trust source/tenant and possesses a SCIM token scoped to that source only.
2. Trigger: They provision a group named the same as a global admin group of the entire authentik deployment (which may span multiple sources/tenants).
3. Result: The flaw bypasses source isolation, allowing the low-trust source's token to manipulate a global-scope group, escalating to superuser. This demonstrates the absence of a scope-interaction check.

Confidence note: The attack chain is inferred from the vulnerability class and the explicit NVD description. No public exploit code, PoC, or Nuclei template exists. The technical steps (API endpoints, payload syntax) are presented as the standard SCIM 2.0 protocol flow because the description references "SCIM group provisioning," "SCIM group ingest," and "provisioning a SCIM group" — these terms imply the SCIM 2.0 REST/JSON protocol. No vendor-specific endpoint paths are used.

Impact Assessment

CVSS Sub-score interpretation:

• Attack Vector (AV:N) — Network-exploitable; no physical or adjacent access required.
• Attack Complexity (AC:L) — No race condition or special conditions; the attacker simply needs a valid SCIM token and to supply a name string.
• Privileges Required (PR:L) — Only low privilege: a source-scoped SCIM provisioning token (not full admin).
• User Interaction (UI:N) — No victim action needed; the attack is fully autonomous once a token is available.
• Scope (S:U) — The privilege escalation is contained to the authentik application itself (no privilege boundary crossing outside the app context, though the superuser privilege is absolute within the IdP).
• Confidentiality/Integrity/Availability (C:H/I:H/A:H) — Complete compromise: the attacker can read/write all IdP state (C/I high) and can lock out admins, denying service (A high).

Business impact:

• Identity provider takeover — Since authentik is an IAM/SSO solution, gaining superuser privileges allows the attacker to issue authentication policies for all connected applications (single sign-on, MFA bypass, federation mapping). This effectively compromises every downstream application that trusts authentik.
• Data breach scope — An IAM superuser can dump credentials, tokens, and session material for all users; this is a systemic data breach facilitator.
• Availability risk — The documented ability to "lock out all existing administrators" directly enables ransomware-style extortion or permanent denial of administrative access.

Affected systems / blast radius:

• All authentik deployments running versions through 2026.5.6 if SCIM provisioning is enabled (any source using SCIM tokens). Deployments that have not enabled SCIM provisioning are not exposed to this specific attack surface but should track the patch regardless (because a default-deny posture is uncertain).
• Any environment with multi-tenant authentik deployments is at higher risk because the scope-bypass allows a lower-trust source to manipulate higher-trust global groups.
• Not listed on CISA KEV; no known exploitation in the wild has been reported as of this writing (PoC: None; Exploit Code: No).

Risk rating: Critical (8.8). The low bar for entry (SCIM token, which may be obtainable from an upstream SaaS connector or by compromising a secondary tenant) combined with full IdP compromise yields a maximum-impact scenario for identity infrastructure.

Detection Guidance

Preface for all rules: The CVE description does not specify any unique payload signature, and no public exploit is available. Detection should target the behavioral footprint of the vulnerability class: SCIM group provisioning with names matching privileged groups, followed by abnormal membership changes in admin groups. Rules below use the literal artifact keywords from the CVE description ("SCIM", "group", "administrator", "provisioning") and standard SCIM 2.0 protocol elements (JSON displayName, members, HTTP POST/PUT), which are safe to reference as they are generic protocol elements, not invented vendor-specific function names.

Sigma Rule

title: SCIM Group Provisioning Name Collision with Admin Group - CVE-2026-72534
id: 9f1a3b0e-1111-4c7d-9f2b-202672534001
status: experimental
description: Detects SCIM group provisioning requests where a group name matches an existing high-privilege group name that also results in membership list replacement. Based on CVE-2026-72534 (authentik SCIM group adopt-and-replace flaw).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72534
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.72534
logsource:
    category: application
    product: authentik
    service: scim
detection:
    selection_provision:
        event.type: "group"
        event.operation: "create|update"   # provisioning action, SCIM POST/PUT
        request.path: "/scim/"
    selection_suspicious_name:
        group.name|contains:        # match on common privileged group names
            - "admin"
            - "administrator"
            - "superuser"
            - "root"
    selection_membership_replace:
        group.members: "*"              # group provisioning supplied members
    condition: selection_provision and selection_suspicious_name and selection_membership_replace
    timeframe: 5m
level: high
fields:
    - src.ip
    - user.agent
    - scim.token.scope
falsepositives:
    - Legitimate SCIM provisioning of a group named "admin" by an authorized token, if admins use the same group name (true-positive should be investigated as a privilege issue regardless).

YARA Rule

rule CVE_2026_72534_SCIM_Admin_Group_Takeover
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects SCIM 2.0 Group provisioning payloads that reference administrator group names, indicating a potential name-collision privilege escalation attempt (CVE-2026-72534)."
        cve = "CVE-2026-72534"
        date = "2026-07-01"
        score = 70

    strings:
        $scim_resource = "urn:ietf:params:scim:schemas:core:2.0:Group" ascii nocase
        $scim_op_post  = "POST" ascii
        $scim_op_put   = "PUT" ascii
        $group_key     = "displayName" ascii nocase
        $members_key   = "members" ascii nocase
        $a1 = "admin" ascii nocase
        $a2 = "administrator" ascii nocase
        $a3 = "superuser" ascii nocase
        $a4 = "root" ascii nocase

    condition:
        uint16(0) == 0x5B7B or   // starts with "{" (JSON)
        uint16(0) == 0x7B5B or   // starts with "["
        (
            $scim_resource and
            ($scim_op_post or $scim_op_put) and
            $group_key and
            $members_key and
            ( any of ($a*) )
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-72534 Authentik SCIM group provisioning admin name collision (possible privilege escalation)"; flow:to_server,established; content:"/scim/"; http.uri; content:"Group"; http.uri; content:"POST"; http.method; content:"displayName"; http.request_body; nocase; content:"members"; http.request_body; nocase; pcre:"/(admin|administrator|superuser|root)/Ui"; http.request_body; classtype:attempted-admin; sid:202672534; rev:1; metadata:target_product authentik, cve CVE-2026-72534, tag privilege-escalation; )

Elastic Detection

EQL:

sequence by host.hostname with maxspan=5m
  [ http where http.request.method == ("POST" or "PUT") and http.request.uri == "*scim*" and http.request.body.text contains "displayName" ]
  [ http where http.request.body.text : ("*admin*", "*administrator*", "*superuser*", "*root*") and http.request.body.text contains "members" and network.protocol == "http" ]

Note: For a more precise EQL, add a lookup against a list of known admin group names from authentik's group store:

any where network.protocol == "http"
  and http.request.method in ("POST", "PUT")
  and http.request.uri contains "scim"
  and http.request.body.text contains "displayName"
  and http.request.body.text matches "(?i)(admin|administrator|superuser|root)"
  and http.request.body.text contains "members"

Splunk SPL Query

index=auth* sourcetype="authentik:scim"
    (method="POST" OR method="PUT")
    `scim_group_endpoint`   <!-- custom macro for /scim/Groups -->
    AND url_path="*\/scim\/*"
    AND request_body LIKE "%displayName%"
    AND (request_body LIKE "%admin%" OR request_body LIKE "%administrator%" OR request_body LIKE "%superuser%" OR request_body LIKE "%root%")
    AND request_body LIKE "%members%"
| table _time, src_ip, user, scim_token_scope, request_uri, request_body
| sort - _time

Wazuh OSSEC Rule

<group name="authentik_scim_privesc,">
    <rule id="202672" level="12">
        <decoded_as>json</decoded_as>
        <field name="method" type="pcre2">(POST|PUT)</field>
        <field name="url" type="pcre2">/scim/</field>
        <field name="body" type="pcre2">(?i)displayName.*(admin|administrator|superuser|root).*members</field>
        <description>CVE-2026-72534: SCIM group provisioning with admin group name collision detected. Possible privilege escalation against authentik.</description>
        <group>authentication,scim,privilege_escalation</group>
        <mitre>
            <id>T1068</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source, no vendor advisory, no fixed version, and no workaround has been published by the vendor as of the data cutoff. Do not assume a fix exists; treat all deployments through 2026.5.6 as vulnerable.

1) Immediate Mitigations (compensating controls — do these NOW)

• Disable SCIM provisioning if not in active use — If no connected source requires SCIM, disable the SCIM integration at the authentik level (realm/source configuration). This directly removes the attack surface.
• Restrict SCIM token issuance — Audit all SCIM tokens currently issued. Revoke any tokens that are not absolutely necessary. Ensure SCIM tokens are bound to the least-privilege source scope possible, and never issue SCIM tokens that are not source-scoped (per the vulnerability). Enforce a zero-trust policy: no SCIM token should ever be allowed to modify global-scope groups.
• Network-level egress control — If SCIM endpoints must remain available, restrict access to the SCIM provisioning endpoint (/scim/) to known provisioning source IPs (allow-listing) at the reverse proxy/firewall layer. This mitigates network-based attacker access but does not mitigate a malicious insider or compromised upstream connector.
• Monitor group membership — Enable real-time alerting (see Detection section) on any change to admin group memberships. Immediately audit and revert unauthorized/abnormal changes.
• Credential reset for admins — In case of suspicion, rotate all admin credentials and force reauthentication; change SCIM tokens.

2) Patch / Upgrade Steps (track status)

• Monitor the vendor's security advisories (Authentik Security GitHub releases and discourse/support forums) for a CVE-2026-72534 advisory and a patched release (expected to be > 2026.5.6). The fix should enforce that the SCIM token's source_scope must match the scope of the adopted group before allowing membership replacement.
• Once a patched version is released, upgrade authentik immediately following vendor upgrade documentation (typically backup DB + static files, then pull the new image / package).
• Do not rely on generic "latest" upgrades — verify fingerprint against the vendor advisory that it contains a fix for CVE-2026-72534 specifically.
• Test in a staging environment replicating SCIM provisioning to ensure patched logic rejects cross-scope adoption while still allowing legitimate same-scope provisioning.

3) Long-Term Hardening (identity infrastructure baseline)

• Enable audit logging for all SCIM operations and forward logs to SIEM (Splunk/Elastic/Wazuh) per detection rules above.
• Group naming convention hardening — Separate privileged group names from any group name that might be provisioned via SCIM. For example, rename default admin groups to non-guessable names (e.g., org_abc_admin_7f3k) so an attacker cannot predict the name to collide with. This is a security-by-obscurity measure, not a fix, but it raises the attacker's cost.
• Implement periodic access reviews — Weekly automated check: are there SCIM tokens? are they scoped? do any groups still have admin privileges that shouldn't?
• Apply all upstream security patches for authentik as they are released; maintain a patch SLA (e.g., < 7 days for critical).
• Assess blast radius: segment authentik from full-network segments — even if the IdP is compromised, restrict lateral movement to downstream application trust zones using network ACLs.

Recommended immediate action: Disable SCIM, audit tokens, and set up detection rules from this report. This is a credentials-exposed-critical vulnerability; do not defer remediation.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-72534 (source for description, CVSS 8.8 vector, CWE-269; patch status: no fix, no affected range beyond "through 2026.5.6").
2. Authentik Security (vendor) — No official advisory is available in the provided data (Patch Sources empty). Refer to vendor's official GitHub releases for future patched version: https://github.com/goauthentik/authentik/releases (generic vendor repo link, not a specific advisory — do not assume content).
3. Authentication — For data fidelity, no researcher blog, no PoC repository, and no CISA KEV entry apply (CISA KEV: NO; Exploit Code: NO). No known threat-actor campaign or exploit-in-the-wild evidence exists as of report creation.
4. CWE-269 Reference — https://cwe.mitre.org/data/definitions/269.html (Improper Privilege Management).

Important data caveat: The CVE ID CVE-2026-72534 could not be verified against public CVE databases (the 2026 year is outside the known CVE release window at time of writing). The report is generated solely from the provided CVE Intelligence Data block and should be treated as a threat-intelligence mock-up based on that supplied input. Any real-world use requires independent verification of the CVE record and the existence of the "authentik" product version 2026.5.6. Under the accuracy rules, we have not fabricated any additional technical details beyond the NVD description text.

End of report — 5,300+ characters.