PT-2024-27821 · Authentik · Authentik

M2A2 · CVE-2024-37905 · Published 2024-06-28 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.2.4 authentik versions prior to 2024.4.2 authentik versions prior to 2024.4.3 authentik versions prior to 2024.6.0

Description The authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the authentik application, including resetting user passwords and more.

Recommendations For versions prior to 2024.2.4, update to version 2024.2.4 or later. For versions prior to 2024.4.2, update to version 2024.4.2 or later. For versions prior to 2024.4.3, update to version 2024.4.3 or later. For versions prior to 2024.6.0, update to version 2024.6.0 or later.

Exploit

Fix

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BIT-AUTHENTIK-2024-37905

CVE-2024-37905

GHSA-C78C-2R9W-P7X4

Affected Products

Authentik

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37905.json · Exploit
• https://github.com/goauthentik/authentik/security/advisories/GHSA-c78c-2r9w-p7x4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37905 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37905 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-authentik-2024-37905 · Vendor Advisory
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4 · Note
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0 · Note
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3 · Note
• https://t.me/cvenotify/84821 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1810246365240266992 · Twitter Post