CRITICAL🇵🇱 Wersja polska

CVE-2026-25227

CVSS 9.1v3.1pub. 2026-02-12upd. 2026-02-19

authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Goauthentik Authentik

    APP
    Goauthentik
    2021.3.1 – 2025.8.6 (bez)2025.10.0 – 2025.10.4 (bez)2025.12.0 – 2025.12.4 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEContainer
CWE
References

Related vulnerabilities

CVE-2026-42849CRITICAL9.3PL ✓ten sam produkt

XSS w AutosubmitStage komponentu SFE w Goauthentik Authentik

CVE-2026-49448CRITICAL9.8PL ✓ten sam produkt

Pominięcie etapu uwierzytelniania (Source Stage) w Goauthentik Authentik

CVE-2024-47070CRITICAL9.0PL ✓ten sam produkt

Pominięcie uwierzytelnienia przez nagłówek X-Forwarded-For w authentik

CVE-2023-46249CRITICAL9.6ten sam produkt

authentik is an open-source Identity Provider. Prior to versions 2023.8.4 and 2023.10.2, when the default admi...

CVE-2023-26481CRITICAL9.1ten sam produkt

authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that ...