CVE-2026-72537

Executive Summary

CVE-2026-72537 is a critical privilege escalation vulnerability in Authentik Security authentik versions through 2026.5.6. An attacker holding a source-scoped SCIM provisioning token can exploit the SCIM user ingestion process to take over any existing local account — including superuser accounts — by provisioning a SCIM user whose username matches an existing local account. The SCIM user ingest function fails to validate scope boundaries, allowing the attacker to rewrite or delete any account without holding elevated privileges. With an CVSS score of 8.8 (High), this vulnerability enables full compromise of the identity provider, which in turn grants access to all downstream applications federated through authentik.

Technical Analysis

Authentik is an open-source identity provider (IdP) that supports SCIM (System for Cross-domain Identity Management) provisioning. SCIM is a standard protocol used to automate the exchange of user identity information between identity domains — typically between an IdP and a service provider. In a typical deployment, organization A provisions users into authentik via SCIM using a provisioning token scoped to a specific source (e.g., an HR system, a tenant, or a partner organization). This token is intended to allow creation and management of users only within that source's scope.

The vulnerability arises from flawed logic in the SCIM user ingestion function. When a SCIM request creates or updates a user, the function performs a lookup by username to determine whether the user already exists in authentik. If a match is found, the function adopts — i.e., takes over — the pre-existing local account without verifying that the account belongs to the SCIM source making the request. This lack of scope-boundary validation means that a provisioning token with limited, source-scoped privileges can overwrite the attributes, credentials, or group memberships of any local account whose username collides with the provisioned SCIM user.

The flaw is a classic "authentication/authorization boundary" failure. The attacker-controlled input (the SCIM user object's username field) is used as the key in a database lookup that crosses trust boundaries. The application fails to enforce that the lookup result is restricted to the authenticated principal's scope. This is categorized under CWE-269 (Improper Privilege Management) because the system does not properly restrict the privileges of the SCIM provisioning token after authentication.

The attack surface is network-exposed — the SCIM provisioning endpoint is typically reachable via HTTPS. The attacker requires only low-privilege credentials (a source-scoped SCIM token), but the impact is high: confidentiality, integrity, and availability are all compromised (C:H/I:H/A:H in the CVSS vector). No user interaction is required (UI:N), and the attack complexity is low (AC:L).

No code-level details (function names, class names, file paths) are available from the NVD description beyond the reference to "the SCIM user ingest function." The precise implementation details of the flawed lookup are not publicly disclosed at the time of writing.

Exploitation Scenarios

The following exploitation chain is inferred from the vulnerability class and the NVD description. No public PoC is available; the attack chain is described at the vulnerability-class level.

Step 1 — Reconnaissance / Target Identification:
The attacker first identifies an authentik instance exposed to the network. This can be done by scanning for the authentik login page or API endpoints (e.g., via Shodan dorks such as http.title:"authentik"). The attacker then obtains a SCIM provisioning token. This token could be obtained through legitimate means (e.g., the attacker is a low-privilege user with access to a source-scoped token, such as an HR system integration or a partner tenant) or through credential theft/phishing of an existing token.

Step 2 — Triggering the Flaw:
The attacker crafts a SCIM provisioning request (either a POST to create a user or a PUT/PATCH to update one) targeting the SCIM Users endpoint. The critical field is the username — the attacker sets it to match the username of a target account, such as admin or superuser. Since the SCIM ingest function performs a lookup by username without validating that the matched account belongs to the SCIM source's scope, the request is accepted.

Step 3 — Payload / Execution Method:
Within the SCIM user object, the attacker can supply attributes that will overwrite the target account. These may include:

• Password or password-hash field (if supported by the SCIM schema), allowing direct credential overwrite.
• Group memberships (via the groups attribute), granting the attacker's controlled account superuser or admin group membership.
• Status fields (e.g., active: false), allowing account denial-of-service by deactivating the target account.
• Email or other identity attributes to redirect password resets or MFA challenges.

Because the privilege check is performed at the token-scope level rather than per-account, the source-scoped token is trusted to modify the matching account regardless of its actual ownership.

Step 4 — Post-Exploitation Impact:
Once the attacker has overwritten the superuser account's credentials or group membership, they can log in as that superuser. This grants full administrative control over the authentik instance, including the ability to:

• Create or delete any user, group, or application.
• Modify IdP configurations.
• Access or exfiltrate secrets stored within authentik.
• Federate into all downstream applications that rely on authentik for authentication (OIDC, SAML, LDAP).
• Disable MFA for other users, broadening the compromise.

Alternatively, the attacker could delete the superuser account entirely (via SCIM DELETE), causing an availability impact and potentially locking out legitimate administrators.

Impact Assessment

Business Impact: This is a critical identity infrastructure compromise. Authentik is the trust anchor for federated authentication across many enterprise applications. Full takeover of the superuser account grants the attacker the ability to impersonate any user, issue tokens for any application, and manipulate identity data at will. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) underscores the severity: network-accessible, low attack complexity, requires only low privileges, no user interaction, and high impact to confidentiality, integrity, and availability.

Affected Systems: All authentik deployments running versions through 2026.5.6 are affected. This includes both self-hosted installations and any managed deployments that have not yet patched. The vulnerability is particularly dangerous in multi-tenant deployments where SCIM provisioning tokens are issued to partners or external organizations — a compromised or malicious partner can escalate to global superuser.

Blast Radius: The blast radius extends beyond authentik itself. Since authentik acts as an identity provider, any application configured to trust authentik for authentication (via OIDC, SAML, LDAP, or proxy) is at risk. An attacker who controls the IdP can forge authentication assertions, steal session tokens, and access any connected application. This makes the vulnerability a "single point of failure" for the entire federated identity ecosystem in an organization. The scope is unchanged (S:U), meaning the compromise is contained to the authentik instance itself, but the downstream impact is organization-wide.

Detection Guidance

Detection of this vulnerability is challenging because standard SCIM provisioning traffic is expected and legitimate. The key differentiator is the pattern of provisioning requests targeting usernames that are not part of the SCIM source's legitimate scope.

Sigma Rule

title: Authentik SCIM Account Takeover via Username Collision
id: 9f6e3b2c-7d1a-4e5f-8b3c-1a2b3c4d5e6f
status: experimental
description: Detects SCIM provisioning requests in authentik that target existing superuser or admin usernames, indicating potential account takeover attempts (CVE-2026-72537).
logsource:
    product: authentik
    service: audit
detection:
    selection_scim:
        event.action: "scim.user.*"
    selection_high_priv_usernames:
        event.data.username|contains:
            - "admin"
            - "superuser"
            - "root"
            - "administrator"
            - "superadmin"
    selection_scope_mismatch:
        event.data.scope|contains: "source"
    condition: selection_scim and selection_high_priv_usernames and selection_scope_mismatch
level: high
falsepositives:
    - Legitimate SCIM provisioning where a source genuinely manages a high-privilege account (rare but possible)
    - Internal provisioning scripts that create admin-named users
tags:
    - cve.2026-72537
    - attack.t1068
    - attack.privilege_escalation

YARA Rule

rule Authentik_SCIM_Account_Takeover {
    meta:
        author = "Valter Security"
        description = "Detects SCIM provisioning payloads targeting high-privilege usernames in authentik logs or network traffic"
        cve = "CVE-2026-72537"
        date = "2026-05-25"
    strings:
        $scim_operation = /("op"\s*:\s*"(Add|Replace|Create)"|"method"\s*:\s*"(POST|PUT|PATCH)")/ nocase
        $username_field = /"userName"\s*:\s*"([^"]+)"/ nocase
        $admin_indicator = /"userName"\s*:\s*"(admin|superuser|root|administrator|superadmin)"/ nocase
        $scim_path = /\/scim\/v2\/\w+?\/(Users|Groups)/ nocase
        $authentik_token = /Authorization:\s*Bearer\s+ak_/ nocase
    condition:
        (uint16(0) == 0x5A4D or $scim_path) and
        $scim_operation and
        $username_field and
        $admin_indicator and
        $authentik_token
}

Suricata IDS Rule

alert http any any -> $AUTHENTIK_SERVERS any ( \
  msg:"AUTHENTIK SCIM Account Takeover Attempt (CVE-2026-72537)"; \
  flow:to_server,established; \
  http.method; \
  content:"POST"; http_method; \
  content:"/scim/v2/"; http_uri; \
  content:"Users"; http_uri; \
  content:"userName"; http_client_body; \
  pcre:"/\"userName\"\s*:\s*\"(admin|superuser|root|administrator|superadmin)\"/i"; \
  content:"Authorization"; http_header; \
  content:"Bearer"; http_header; \
  sid:10072537; rev:1; \
  classtype:attempted-admin; \
  reference:cve,2026-72537; \
  metadata:created_at 2026-05-25, updated_at 2026-05-25;)

Elastic Detection

// EQL rule to detect SCIM provisioning attempts targeting high-privilege accounts in authentik
any where
  event.category == "authentication" and
  event.action == "scim_user_provision" and
  (
    user.name == "admin" or
    user.name == "superuser" or
    user.name == "root" or
    user.name == "administrator" or
    user.name == "superadmin"
  ) and
  // SCIM tokens are scope-limited; high-privilege target is a red flag
  not source.packages.name == "authentik-internal-provisioning-scope"

Splunk SPL Query

index=authentik sourcetype=audit_log
| where event.action LIKE "scim.user.%"
| search event.data.username IN ("admin", "superuser", "root", "administrator", "superadmin")
| eval scope = if(match(event.data.scope, "source"), "source-scoped", "other")
| where scope == "source-scoped"
| stats count by username, src_ip, user_agent, date_hour
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="authentik,">
    <rule id="100725" level="14">
        <decoded_as>json</decoded_as>
        <field name="event.action">^scim\.user\.</field>
        <field name="event.data.username">^(admin|superuser|root|administrator|superadmin)$</field>
        <description>AUTHENTIK: SCIM provisioning request targeting high-privilege account: $(event.data.username). Potential CVE-2026-72537 account takeover.</description>
        <group>authentication,privilege_escalation,</group>
        <mitre>
            <id>T1068</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. As of this report, no public patch is available from Authentik for CVE-2026-72537. The affected version range is 2026.5.6 and earlier.

Immediate Mitigations (compensating controls):

1. Audit all SCIM provisioning tokens — immediately review all existing SCIM tokens and revoke any that are not strictly necessary. Minimize the number of source-scoped tokens and ensure they are issued only to trusted, verified sources.
2. Network-level restrictions — restrict access to the SCIM endpoint (/scim/v2/) to only the expected source IP addresses via firewall or reverse-proxy allowlists. This reduces the likelihood of external attackers reaching the endpoint.
3. Enable MFA on all superuser and admin accounts — if MFA is already enabled, ensure it cannot be bypassed by SCIM attribute overwrite (test this in a staging environment if possible).
4. Monitor SCIM logs aggressively — deploy detection rules (such as the Sigma rule above) to alert on any SCIM provisioning targeting existing usernames, particularly high-privilege ones.
5. Regularly rotate SCIM tokens — if you cannot patch immediately, rotate SCIM provisioning tokens on a frequent schedule to reduce the window of a leaked-token attack.

Patch / Upgrade Steps:

• Monitor the Authentik GitHub releases page and security advisories for a patched version that addresses this vulnerability.
• Once a patched version is available (expected to be > 2026.5.6), upgrade all authentik instances promptly. Test in staging before production rollout.
• If an upgrade is not immediately feasible, consider temporarily disabling SCIM provisioning entirely and performing user provisioning through manual or alternative automated means.

Long-Term Hardening:

1. Enforce scope boundary validation — after patching, verify in a test environment that SCIM provisioning cannot overwrite accounts outside the provisioned source scope.
2. Implement separate, dedicated service accounts for SCIM with the absolute minimum permissions required (principle of least privilege).
3. Adopt a Zero Trust posture for identity infrastructure — treat SCIM endpoints as sensitive and monitor them with the same rigor as authentication endpoints.
4. Regular vulnerability scanning of the authentik instance to catch similar privilege escalation issues early.
5. Maintain incident response runbooks for identity provider compromise, including procedures for rotating all downstream application secrets and re-establishing trust relationships.

References

1. NVD Entry for CVE-2026-72537: https://nvd.nist.gov/vuln/detail/CVE-2026-72537
2. Authentik Security Advisories (check for updates): https://goauthentik.io/security/
3. Authentik GitHub Releases: https://github.com/goauthentik/authentik/releases
4. CWE-269 Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
5. Shodan search for exposed authentik instances: https://www.shodan.io/search?query=http.title%3A%22authentik%22

Threat Actor Activity / Exploit-in-the-Wild: As of the writing of this report, no public exploit code or confirmed in-the-wild exploitation has been reported for CVE-2026-72537. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is unpatched, which increases the likelihood of future exploit development. Security teams should treat this as a high-priority finding and apply mitigations immediately.