PT-2026-7892 · Authentik · Authentik

Rahulgovind · Publicado 2026-02-12 · Atualizado 2026-04-16 · CVE-2026-25227

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions authentik versions 2021.3.1 through 2025.8.6 authentik versions 2025.10.4 authentik versions 2025.12.4

Description authentik is an open-source identity provider. When using delegated permissions, a user with the permission 'Can view * Property Mapping' or 'Can view Expression Policy' can execute arbitrary code within the authentik server container through the test endpoint. This endpoint is intended for previewing how a property mapping or policy works. The issue allows for code execution due to improper access controls on the test endpoint.

Recommendations authentik versions prior to 2025.8.6 should be updated. authentik version 2025.10.4 should be updated. authentik version 2025.12.4 should be updated.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BIT-AUTHENTIK-2026-25227

CVE-2026-25227

GHSA-QVXX-MFM6-626F

Produtos afetados

Authentik

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25227.json · Exploit
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.8.6 · Nota
• https://github.com/goauthentik/authentik/security/advisories/GHSA-qvxx-mfm6-626f · Aviso do Fabricante
• https://github.com/goauthentik/authentik/commit/c691afaef164cf73c10a26a944ef2f11dbb1ac80 · Correção
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.10.4 · Nota
• https://github.com/goauthentik/authentik/releases/tag/version%2F2025.12.4 · Nota
• https://twitter.com/offseq/status/2022189039097393415 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2022037595115389055 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-authentik-2026-25227 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-25227 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2022071095919067189 · Publicação no Twitter
• https://reddit.com/r/selfhosted/comments/1r3o9od/authentik_current_release_patches_cves · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2026-25227 · Nota de Segurança