CVE-2026-40172

{"id": "CVE-2026-40172", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40172", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T19:14:39.079892Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "goauthentik", "product": "authentik", "versions": [{"status": "affected", "version": "< 2025.12.5"}, {"status": "affected", "version": ">= 2026.2.0-rc1, < 2026.2.3"}]}]}], "published": "2026-05-22T19:17:03.893", "references": [{"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/goauthentik/authentik/releases/tag/version%2F2026.2.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-h6x7-hjjc-wjc9", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/{pk}/ API allows a caller with change_user on a target user to assign arbitrary groups through UserSerializer, including groups with is_superuser=True, without requiring enable_group_superuser, leading to privilege escalation. This bypasses the stricter permission model enforced in group-management paths and enables delegated user-management permissions to escalate target users to administrator-equivalent privilege. Users with permissions to update groups or permissions to update users are able to add themselves or other users they have permissions on to users which have superuser permissions. This issue has been fixed in versions 22025.12.5 and 2026.2.3."}, {"lang": "es", "value": "authentik es un proveedor de identidad de c\u00f3digo abierto. En versiones anteriores a la 2025.12.5 y de la 2026.2.0-rc1 a la 2026.2.2, la API PATCH /api/v3/core/users/{pk}/ permite a un llamador con 'change_user' sobre un usuario objetivo asignar grupos arbitrarios a trav\u00e9s de UserSerializer, incluyendo grupos con 'is_superuser=True', sin requerir 'enable_group_superuser', lo que lleva a una escalada de privilegios. Esto elude el modelo de permisos m\u00e1s estricto aplicado en las rutas de gesti\u00f3n de grupos y permite que los permisos delegados de gesti\u00f3n de usuarios escalen a los usuarios objetivo a privilegios equivalentes a los de administrador. Los usuarios con permisos para actualizar grupos o permisos para actualizar usuarios pueden a\u00f1adirse a s\u00ed mismos o a otros usuarios sobre los que tienen permisos a usuarios que tienen permisos de superusuario. Este problema ha sido solucionado en las versiones 22025.12.5 y 2026.2.3."}], "lastModified": "2026-07-23T16:10:00.137", "sourceIdentifier": "security-advisories@github.com"}