CVE-2026-94609Published
authentik: Privilege Escalation to Superuser via Group Hierarchy
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-94609 · Microsoft / collected KEV context
cve-program · CVE-2026-94609
- https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc
- https://github.com/goauthentik/authentik/pull/25956
- https://github.com/goauthentik/authentik/pull/25961
- https://github.com/goauthentik/authentik/pull/25966
- https://github.com/goauthentik/authentik/pull/25971
- https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030
- https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87
- https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60
- https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67
- https://docs.goauthentik.io/releases/2026.2#fixed-in-202627
- https://docs.goauthentik.io/releases/2026.5#fixed-in-202657
- https://docs.goauthentik.io/releases/2026.8#fixed-in-202682
- https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7
- https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7
- https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.