An authorization bypass vulnerability in goauthentik allows authenticated users to perform unauthorized actions by manipulating user-controlled keys.

The application suffers from authorization bypass (CWE-639) and incorrect authorization (CWE-863) flaws, where user-controlled keys are not correctly validated during authorization checks.

As an identity provider, a compromise of authentik is critical, potentially allowing attackers to escalate privileges or access resources they are not entitled to. The CVSS score of 8.8 underscores the severity of this access control failure, which could lead to widespread unauthorized access across integrated services.

Immediate Action: Update goauthentik to version 2026.2.6 or 2026.5.5, depending on the current branch in use, to resolve the authorization logic errors.

Proactive Monitoring: Review audit logs for anomalous authorization decisions or users accessing resources outside of their expected scope.

Compensating Controls: Implement strict Network Access Control (NAC) and monitor for unusual API request patterns that might indicate an attempt to exploit authorization keys.

Public Exploit Available: No

Given the central role of authentik in identity management, this patch should be applied with high urgency. Failure to remediate could allow authenticated users to circumvent security controls and gain unauthorized access to protected enterprise resources.