CVE-2026-72537

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72537", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T10:32:49.080Z", "datePublished": "2026-08-11T11:07:22.941Z", "dateUpdated": "2026-08-11T12:40:39.574Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-11T11:07:22.941Z"}, "title": "Authentik Security authentik - Privilege Escalation", "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential."}], "affected": [{"vendor": "Authentik Security", "product": "authentik", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2026.5.6", "versionType": "custom"}]}], "references": [{"url": "https://github.com/goauthentik/authentik", "name": "Project Repository"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "value": "Bobur Abdugafforov (Mahadsec)", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T12:38:53.759720Z", "id": "CVE-2026-72537", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T12:40:39.574Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72537", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T12:38:53.759720Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T12:40:21.853Z"}}], "cna": {"title": "Authentik Security authentik - Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Bobur Abdugafforov (Mahadsec)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Authentik Security", "product": "authentik", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.5.6"}]}], "references": [{"url": "https://github.com/goauthentik/authentik", "name": "Project Repository"}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-11T11:07:22.941Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72537", "state": "PUBLISHED", "dateUpdated": "2026-08-11T12:40:39.574Z", "dateReserved": "2026-08-10T10:32:49.080Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-11T11:07:22.941Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "authentik", "vendor": "Authentik Security", "versions": [{"lessThanOrEqual": "2026.5.6", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios en Authentik Security authentik hasta 2026.5.6 permite a un atacante con un token de aprovisionamiento SCIM con \u00e1mbito de origen tomar el control de cualquier cuenta de usuario, incluyendo superusuarios, mediante el aprovisionamiento de un usuario SCIM que coincide con un usuario local existente por nombre de usuario. La funci\u00f3n de ingesta de usuarios SCIM adopta cuentas locales preexistentes por nombre de usuario sin validar los l\u00edmites de \u00e1mbito. Un atacante puede reescribir o eliminar cualquier cuenta, incluyendo el superusuario, utilizando solo una credencial de aprovisionamiento limitada."}], "id": "CVE-2026-72537", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72537", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T12:38:53.759720Z", "version": "2.0.3"}}]}, "published": "2026-08-11T12:17:38.977", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/goauthentik/authentik"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.5.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "authentik", "source": "cna", "vendor": "Authentik Security"}, "product": "authentik", "vendor": "authentik_security"}], "created": "2026-08-11T17:15:06.755566+00:00", "updated": "2026-08-13T09:54:50.366673+00:00", "vendors": ["authentik_security", "authentik_security$PRODUCT$authentik"]}