CVE-2026-94611Published
authentik: Stored credentials are readable with view permission alone
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-94611 · Microsoft / collected KEV context
cve-program · CVE-2026-94611
- https://github.com/goauthentik/authentik/security/advisories/GHSA-m9h4-7j9c-55x9
- https://github.com/goauthentik/authentik/pull/25955
- https://github.com/goauthentik/authentik/pull/25960
- https://github.com/goauthentik/authentik/pull/25965
- https://github.com/goauthentik/authentik/pull/25970
- https://github.com/goauthentik/authentik/commit/4b3fad38be44ef3eef1f0baf83e7b3061229eb99
- https://github.com/goauthentik/authentik/commit/5109a4d4998d6a5ee399ca3e22ba546231c140c7
- https://github.com/goauthentik/authentik/commit/6bed64ef80a4dd21011cce64c41b1e7c5640ecb3
- https://github.com/goauthentik/authentik/commit/77d2e24442c3eb6e88010f40aa569a8bfb584f99
- https://docs.goauthentik.io/releases/2026.2#fixed-in-202627
- https://docs.goauthentik.io/releases/2026.5#fixed-in-202657
- https://docs.goauthentik.io/releases/2026.8#fixed-in-202682
- https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7
- https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7
- https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.