Authentik Privilege Escalation Vulnerability via Arbitrary Superuser Group Assignment

A vulnerability in authentik, an open-source identity provider, allows for unauthorized privilege escalation by assigning superuser groups to users through the PATCH /api/v3/core/users/{pk}/ API. This issue is present in authentik versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2. The vulnerability arises because the API allows users with 'change_user' permissions to assign any group, including those with superuser rights, without the necessary safeguards. As a result, users can escalate their privileges to that of an administrator.

Impact

Exploitation of this vulnerability allows users with the ability to update groups or users to grant themselves or others superuser privileges, effectively elevating their rights to that of an administrator.

Remediation

Users can upgrade to authentik versions 2025.12.5 or 2026.2.3 to address this vulnerability.