Authentik SCIM Token Privilege Escalation via Username Collision

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attacker can rewrite or delete any account, including the superuser, using only a limited provisioning credential.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-72537 represents a critical privilege escalation vulnerability in Authentik Security's identity management platform affecting versions through 2026.5.6. The flaw exists in the SCIM (System for Cross-domain Identity Management) user provisioning function, which fails to validate scope boundaries when adopting pre-existing local accounts by username. An attacker possessing a source-scoped SCIM provisioning token—a lower-privileged credential intended for limited account creation—can exploit username collision to take over any existing user account, including superuser accounts. This represents a complete authentication bypass and account takeover scenario, making it particularly dangerous for organizations relying on Authentik for identity governance across their infrastructure.

Casky's 224 matched security skills leverage Claude AI's extended reasoning to detect the sophisticated attack patterns underlying TA0004 (Privilege Escalation) techniques. Practitioners using Casky would identify suspicious indicators including: unexpected SCIM provisioning API calls modifying existing user accounts rather than creating new ones, privilege level changes on accounts modified through SCIM tokens with limited scope, username-matching patterns between provisioning requests and existing superuser accounts, and audit log anomalies showing account modifications via tokens that should lack such permissions. The platform's skill mapping would surface abnormal authentication patterns and account control changes, enabling security teams to spot attackers attempting to weaponize provisioning tokens for lateral movement and privilege escalation before infrastructure compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72537.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-72537

Casky has 224 skills that investigate the attack patterns behind CVE-2026-72537. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn