CRITICAL🇵🇱 Wersja polska

CVE-2026-25227

CVSS 9.1v3.1pub. 2026-02-12upd. 2026-02-19

authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

🤖 AI Analysis
How it works

A user with delegated permission 'Can view * Property Mapping' or 'Can view Expression Policy' can invoke a test endpoint that is used to preview the behavior of a property mapping or expression-based policy. This endpoint does not impose adequate restrictions on executed code, allowing submission and execution of arbitrary expressions (CWE-94: Improper Control of Code Generation). As a result, the attacker gains the ability to execute arbitrary code directly in the context of the authentik server container.

Impact

An attacker can execute arbitrary code inside the authentik container, leading to complete takeover of the server instance — including disclosure of sensitive data, modification of configuration, and potential further movement in the environment (lateral movement).

Mitigation & patch

authentik should be updated to version 2025.8.6, 2025.10.4, or 2025.12.4, which contain a fix for this issue. Details are available in official releases on GitHub and in advisory GHSA-qvxx-mfm6-626f.

Who is affected

Goauthentik authentik in versions from 2021.3.1 to (not including) 2025.8.6, 2025.10.4, and 2025.12.4

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Goauthentik Authentik

    APP
    Goauthentik
    2021.3.1 – 2025.8.6 (excl.)2025.10.0 – 2025.10.4 (excl.)2025.12.0 – 2025.12.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEContainer
CWE
References

Related vulnerabilities

CVE-2026-42849CRITICAL9.3PL ✓same product

XSS w AutosubmitStage komponentu SFE w Goauthentik Authentik

CVE-2026-49448CRITICAL9.8PL ✓same product

Pominięcie etapu uwierzytelniania (Source Stage) w Goauthentik Authentik

CVE-2024-47070CRITICAL9.0PL ✓same product

Pominięcie uwierzytelnienia przez nagłówek X-Forwarded-For w authentik

CVE-2023-46249CRITICAL9.6PL ✓same product

authentik — pominięcie uwierzytelnienia przy resetowaniu hasła admina

CVE-2023-26481CRITICAL9.1PL ✓same product

Authentik: przejęcie konta przez nieprawidłową walidację tokenu odzyskiwania