CVE-2026-94609 describes an improper privilege management vulnerability in the open-source identity provider goauthentik authentik. Before versions 2026.2.7, 2026.5.7, and 2026.8.2, accounts delegated permissions to manage groups, group membership, or users could escalate privileges by granting superuser status or assigning roles without holding the necessary permissions. The flaw arises because group hierarchy checks do not consistently consider superuser status inherited from ancestor groups, and role assignments to groups lack required authorization checks. Only deployments delegating these management capabilities to non-full administrator accounts are affected. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity.

Exploitation allows accounts with delegated management permissions to escalate their privileges to superuser status or assign roles improperly, potentially leading to full administrative control. This can compromise confidentiality, integrity, and availability of the authentik identity provider environment.

Upgrade authentik to versions 2026.2.7, 2026.5.7, or 2026.8.2 or later, where this vulnerability is fixed. No additional mitigation is required once these versions are deployed.