Authentik SCIM Group Provisioning Privilege Escalation

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects Authentik identity management through version 2026.5.6 and allows attackers with source-scoped SCIM provisioning tokens to escalate privileges to superuser level. The attack exploits improper validation in the SCIM group ingest function, which adopts existing groups by name without verifying that the provisioning source has authorization to modify those groups. An attacker can provision a SCIM group matching an existing administrator group name, causing the system to replace the legitimate group's membership with attacker-controlled accounts. This is a critical issue for any organization using Authentik as their identity provider, as it enables complete identity system compromise and lateral movement across dependent applications.

Casky's 224 mapped skills detect this attack pattern through TA0004 (Privilege Escalation) analysis using Claude's extended reasoning to identify several attack indicators. Practitioners would see detections for: (1) SCIM API calls from unexpected sources attempting group creation with administrator-matching names, (2) Group membership modifications that violate expected source scope boundaries, (3) Token usage patterns where provisioning credentials are used to modify high-privileged groups, and (4) Post-exploitation lateral movement where newly-elevated accounts access protected IdP functions. The platform's skill-mapping would flag the breakdown in authorization validation—specifically the gap between scope restrictions on the token and actual enforced permissions on group modifications—allowing security teams to identify both active exploitation attempts and misconfigurations that leave systems vulnerable.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72534.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-72534

Casky has 224 skills that investigate the attack patterns behind CVE-2026-72534. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn