This vulnerability in authentik involves improper privilege management (CWE-269) where the SCIM group ingest function does not validate the source scope of a provisioning token against the target group. An attacker with a source-scoped SCIM provisioning token can provision a SCIM group named identically to an existing administrator group. The function then replaces the existing group's membership with the attacker's controlled membership, granting the attacker superuser privileges. This flaw allows privilege escalation to full IdP superuser access and can lock out all existing administrators. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

An attacker with a source-scoped SCIM provisioning token can escalate privileges to full superuser access in the authentik IdP environment. This enables complete control over the identity provider, including the ability to lock out legitimate administrators, potentially disrupting identity and access management operations and compromising system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict issuance and use of SCIM provisioning tokens to trusted parties only and monitor provisioning activities closely for suspicious group modifications. Avoid provisioning SCIM groups that match existing administrator group names.