CyberRota Analysis
AI-GeneratedA privilege escalation vulnerability in Authentik Security allows an attacker with a source-scoped SCIM provisioning token to take control of any user account, including superusers, by creating a SCIM user that matches an existing local username. This flaw arises from the lack of scope validation during the user ingestion process, enabling unauthorized account manipulation. Organizations using Authentik Security should prioritize patching this vulnerability to protect against potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.