authentik, an open-source identity provider, contained an improper privilege management vulnerability (CWE-269) in its user update API. Specifically, the PATCH /api/v3/core/users/{pk}/ endpoint allowed callers with the change_user permission to assign any groups to a user, including groups with is_superuser=True, without enforcing the enable_group_superuser requirement. This flaw bypassed the intended stricter permission checks in group management paths, enabling delegated user-management permissions to escalate privileges to superuser level. The vulnerability affects authentik versions before 2025.12.5 and versions from 2026.2.0-rc1 up to but not including 2026.2.3. The issue has been resolved in versions 2025.12.5 and 2026.2.3.

An attacker or user with the change_user permission on a target user can escalate privileges by assigning superuser groups to that user. This results in administrator-equivalent access, potentially allowing full control over the authentik system. The vulnerability does not affect confidentiality but has high impact on integrity and availability due to privilege escalation.

Upgrade authentik to version 2025.12.5 or later, or to version 2026.2.3 or later. These versions contain the fix that enforces the enable_group_superuser requirement and prevents unauthorized assignment of superuser groups via the PATCH user API. Patch status is confirmed fixed in these versions. No other mitigations are indicated.