Improper access control in authentik - CVE-2026-49443
Published: May 29, 2026
Vulnerability identifier: #VU132753
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49443
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to authenticate as another user and gain that user's privileges.
The vulnerability exists due to improper access control in UserSourceConnectionSerializer and GroupSourceConnectionSerializer when handling API requests that modify source connection objects. A remote user can modify the user or group fields in a source connection to authenticate as a victim account and gain that user's privileges.
Exploitation requires the ability to change a source connection object and access to an account in one of the configured sources.
Affected software
authentik
How to mitigate CVE-2026-49443
Install security update from vendor's website.
authentik - addressed in versions 2025.12.6, 2026.2.4, 2026.5.2