CVE-2026-61574 is an authorization bypass vulnerability in the goauthentik authentik identity provider. The Remote Access Control endpoint list improperly returns all configured endpoints and their connection details, including stored credentials, to any authenticated user without enforcing access controls. Additionally, the connection flow does not verify that an endpoint belongs to the Remote Access Control application through which it was launched. This allows any authenticated user to read all endpoints and open connections to endpoints belonging to other applications, exposing credentials for managed RDP, SSH, and VNC targets and granting unauthorized interactive access. The vulnerability affects authentik versions prior to 2026.2.6 and 2026.5.5 and is resolved in these fixed versions.

An authenticated user can bypass authorization controls to view all configured Remote Access Control endpoints and their stored credentials, including for RDP, SSH, and VNC targets. This exposure can lead to unauthorized interactive access to systems the user is not permitted to access, compromising confidentiality, integrity, and availability of those systems.

This vulnerability is fixed in authentik versions 2026.2.6 and 2026.5.5. Users should upgrade to one of these versions or later to remediate the issue. Deployments not using the enterprise Remote Access Control provider are not affected. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the issue is fixed in these versions.