A critical privilege escalation vulnerability in goauthentik allows non-administrator users with delegated management rights to grant themselves superuser status, posing a severe risk of unauthorized access.

This is an improper privilege management and authorization flaw (CWE-269, CWE-863) that occurs because group hierarchy checks and role assignment logic fail to validate administrative status correctly. An attacker must have existing delegated management permissions to trigger this exploit.

The ability for a delegated user to escalate to superuser status represents a total compromise of the identity provider. Successful exploitation grants the attacker full control over the authentication service, potentially leading to unauthorized access to all integrated enterprise applications, exfiltration of sensitive identity data, and complete system takeover. With a CVSS score of 8.8, this vulnerability is considered High severity, as it bypasses intended security boundaries for identity management.

Immediate Action: Update to versions 2026.2.7, 2026.5.7, or 2026.8.2 immediately to apply the necessary authorization checks.

Proactive Monitoring: Audit logs for unusual administrative actions, specifically monitoring for unexpected user role changes or the elevation of accounts to superuser status.

Compensating Controls: Restrict delegated management permissions to the absolute minimum required number of users until the patch can be deployed to reduce the potential attack surface.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Given the high CVSS score and the existence of a public proof-of-concept, the risk of exploitation is significant for any organization utilizing delegated administration in goauthentik. Administrators must prioritize patching these specific versions immediately to prevent unauthorized privilege escalation and ensure the integrity of their identity management infrastructure.