---
id: CVE-2026-94609
title: authentik is an open-source identity provider
summary: >-
  authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7,
  and 2026.8.2, an account with delegated permission to manage a group, group
  membership, or a user can grant superuser status to an account or assign an
  existing …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
  - CWE-863
vendor: goauthentik
product: authentik
affected:
  - authentik < 2026.2.7
  - 'authentik >= 2026.5.0, < 2026.5.7'
  - 'authentik >= 2026.8.0, < 2026.8.2'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T17:17:17.230'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94609'
references:
  - url: 'https://docs.goauthentik.io/releases/2026.2#fixed-in-202627'
    label: security-advisories@github.com
  - url: 'https://docs.goauthentik.io/releases/2026.5#fixed-in-202657'
    label: security-advisories@github.com
  - url: 'https://docs.goauthentik.io/releases/2026.8#fixed-in-202682'
    label: security-advisories@github.com
  - url: >-
      https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030
    label: security-advisories@github.com
  - url: >-
      https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87
    label: security-advisories@github.com
  - url: >-
      https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60
    label: security-advisories@github.com
  - url: >-
      https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67
    label: security-advisories@github.com
  - url: 'https://github.com/goauthentik/authentik/pull/25956'
    label: security-advisories@github.com
  - url: 'https://github.com/goauthentik/authentik/pull/25961'
    label: security-advisories@github.com
  - url: 'https://github.com/goauthentik/authentik/pull/25966'
    label: security-advisories@github.com
  - url: 'https://github.com/goauthentik/authentik/pull/25971'
    label: security-advisories@github.com
  - url: 'https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7'
    label: security-advisories@github.com
  - url: 'https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7'
    label: security-advisories@github.com
  - url: 'https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
  - exploit-available
ingestedAt: '2026-09-24T16:47:15.854Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/anthonyk2923/CVE-2026-94609'
  checkedAt: '2026-09-25T08:21:25.646Z'
exploitAvailable: true
---

## Overview

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.